search engine redirects

A1042nd · April 11, 2011

Hi!

I've been infected with something that is redirecting the hyperlinks in our search engines. I have followed the instructions on your "what to do when I'm infected" page. I believe that the original infection was able to be removed by MBAM, but the redirecting continues. Any help you can offer would be great - thanks!

Here's the original MBAM log and the most recent one.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6299

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/7/2011 8:32:21 AM

mbam-log-2011-04-07 (08-32-21).txt

Scan type: Quick scan

Objects scanned: 221793

Time elapsed: 14 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 2

Registry Keys Infected: 0

Registry Values Infected: 21

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 43

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\expahost.dll (Trojan.Agent.Gen) -> Delete on reboot.

c:\WINDOWS\ahacicoj.dll (IPH.Trojan.Hiloti.B) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lvineg (IPH.Trojan.Hiloti.B) -> Value: Lvineg -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE (Malware.Gen) -> Value: CTNOTIFY.EXE -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Disc Detector (Malware.Gen) -> Value: Disc Detector -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher (Malware.Gen) -> Value: Adobe Reader Speed Launcher -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe ARM (Malware.Gen) -> Value: Adobe ARM -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\REAL\REALPLAYER\UPDATE\REALSCHED.EXE (Malware.Gen) -> Value: REALSCHED.EXE -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TkBellExe (Malware.Gen) -> Value: TkBellExe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched (Malware.Gen) -> Value: SunJavaUpdateSched -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QuickTime Task (Malware.Gen) -> Value: QuickTime Task -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper (Malware.Gen) -> Value: iTunesHelper -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cleanhdd (Malware.Gen) -> Value: cleanhdd -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\expahost.dll (Trojan.Agent.Gen) -> Delete on reboot.

c:\WINDOWS\ahacicoj.dll (IPH.Trojan.Hiloti.B) -> Delete on reboot.

c:\program files\Creative\ShareDLL\CtNotify.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\common files\Adobe\ARM\1.0\AdobeARM.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\real\realplayer\Update\realsched.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\common files\Java\java update\jusched.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\quicktime\QTTask.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\iTunes\ituneshelper.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\application data\cleanhdd.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\application data\windows32.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\19455796.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\vmoqecwufx .exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\vmoqecwufx.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\SYSTEM32\expahost.dll (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\7a.tmp.exe (Trojan.QHosts) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\7d.tmp.exe (Trojan.QHosts) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\bshn.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\hkstnd.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdk.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdl .exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdl .exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdl.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdm.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdn.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdo.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdp.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdq.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdr.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdt.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdu.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\local settings\Temp\Kdv.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\temp2019185512642122.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Kgejaa.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\ntraevi.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.

c:\WINDOWS\nvsvc32 .exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\nvsvc32.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\Aaron\application data\cleanhdd.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6299

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/9/2011 8:32:30 AM

mbam-log-2011-04-09 (08-32-30).txt

Scan type: Quick scan

Objects scanned: 223367

Time elapsed: 11 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Mommy at 9:52:13.96 on Sat 04/09/2011

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.201 [GMT -5:00]

.

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Mommy\Local Settings\Temporary Internet Files\Content.IE5\NN5JZ13D\HiJackThis[1].exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Mommy\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uDefault_Page_URL = hxxp://www.dellnet.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: {4E7BD74F-2B8D-469E-95BA-ED6DB186BE32} - No File

TB: {A3704FA3-DBF6-46B5-B95E-0677DFD39577} - No File

TB: {5A074B29-F830-49DE-A31B-5BB9D7F6B407} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

uPolicies-explorer: <NO NAME> =

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F}

DPF: JT's Blocks - hxxp://download.games.yahoo.com/games/clients/y/blt1_x.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: Toki Toki Boom - hxxp://download.games.yahoo.com/games/clients/y/vto_x.cab

DPF: Yahoo! Chess - hxxp://download.games.yahoo.com/games/clients/y/ct2_x.cab

DPF: Yahoo! Gin - hxxp://download.games.yahoo.com/games/clients/y/nt1_x.cab

DPF: Yahoo! Pool 2 - hxxp://download.games.yahoo.com/games/clients/y/pote_x.cab

DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1298778219171

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} - hxxp://c.ancestry.com/MFInstall/MFInstall.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

TCP: {531789D3-E103-4B2C-80B3-D76844EF54D8} = 216.165.129.157,134.215.200.126

Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

Hosts: 209.172.52.65 www.google.com

Hosts: 209.172.52.66 search.yahoo.com

.

============= SERVICES / DRIVERS ===============

.

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-27 216400]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-25 29584]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-6-27 243024]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-11-8 308136]

S0 tmuyxp;tmuyxp;c:\windows\system32\drivers\aywiy.sys --> c:\windows\system32\drivers\aywiy.sys [?]

S3 Bulk503;Chameleon Mega Digital Camera;c:\windows\system32\drivers\bulk503.sys --> c:\windows\system32\drivers\Bulk503.sys [?]

S3 ISO503;Chameleon Mega Video Camera;c:\windows\system32\drivers\iso503.sys --> c:\windows\system32\drivers\ISO503.SYS [?]

S3 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-11-13 204800]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-29 24652]

.

=============== File Associations ===============

.

.reg=regedit

.

=============== Created Last 30 ================

.

2011-04-09 13:12:22 -------- d-----w- c:\program files\CCleaner

2011-04-08 18:18:03 -------- d-----w- c:\docume~1\mommy\applic~1\SUPERAntiSpyware.com

2011-04-08 18:18:03 -------- d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2011-04-08 18:17:43 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-04-07 01:10:59 -------- d-----w- c:\docume~1\mommy\locals~1\applic~1\{71078740-CEDC-4130-9508-FA335982D15E}

2011-04-07 00:53:29 0 ----a-w- c:\windows\Gkiqofusocacez.bin

2011-04-06 23:29:28 90112 --sha-r- c:\windows\system32\riched32U.dll

2011-04-05 23:09:10 28 ----a-w- c:\windows\p7346712213.exe

2011-04-05 02:25:54 28 ----a-w- c:\windows\p73467113.exe

2011-03-28 05:25:53 -------- d-----w- c:\program files\iPod

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-03-28 05:22:44 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-03-28 05:22:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-03-28 05:18:09 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2011-03-28 05:18:09 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-03-28 05:17:03 -------- d-----w- c:\program files\Bonjour

2011-03-21 03:42:54 -------- d-----w- c:\program files\common files\Software Update Utility

2011-03-15 13:20:00 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files

2011-03-12 17:28:40 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

.

==================== Find3M ====================

.

2011-02-09 13:53:52 270848 ------w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ------w- c:\windows\system32\encdec.dll

2011-02-03 03:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-02-03 01:19:39 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll

.

============= FINISH: 9:54:18.04 ===============

screen317 · April 13, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log. Then run DDS again and post DDS.txt here please.

A1042nd · April 14, 2011

Hi,

Here are fresh logs from the Malwarebytes scan and the DDS scan.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6362

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/14/2011 10:08:09 AM

mbam-log-2011-04-14 (10-08-09).txt

Scan type: Quick scan

Objects scanned: 228430

Time elapsed: 13 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Mommy at 10:09:39.90 on Thu 04/14/2011

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.245 [GMT -5:00]

.

AV: Kaspersky Internet Security *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\devldr32.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Outlook Express\msimn.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe

C:\Documents and Settings\Mommy\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uDefault_Page_URL = hxxp://www.dellnet.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File

BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2011\ievkbd.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: {4E7BD74F-2B8D-469E-95BA-ED6DB186BE32} - No File

TB: {A3704FA3-DBF6-46B5-B95E-0677DFD39577} - No File

TB: {5A074B29-F830-49DE-A31B-5BB9D7F6B407} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2011\avp.exe"

dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

uPolicies-explorer: <NO NAME> =

IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2011\ie_banner_deny.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2011\klwtbbho.dll