My Google has Been Hijacked

LakeOrion · June 13, 2011

I am suffering from the hijacking of my Google searches.

Below are my DDS and Malwarbytes log files, and I've zipped and attached the other requested logs.

I haven't even tried my Google again yet...awaiting your instructions!

Thanks very much!

- Andy

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Mama at 10:26:42 on 2011-06-13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3061.2254 [GMT -4:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\PROGRA~1\PERMIS~1\bin\dm.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

C:\WINDOWS\system32\qcap32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\d3dim70032.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\FixCamera.exe

C:\WINDOWS\vsnp2std.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\hphmon05.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Verizon V CAST Media Manager\V CAST Backup Scheduler.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.weather.com/weather/today/48362

uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080318

uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll

BHO: 5c3db312: {d594d5cf-32c9-35d8-5c9e-63669ab3fb5f} - c:\windows\system32\kbdhe31932.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [HLBackupScheduler] c:\program files\verizon v cast media manager\V CAST Backup Scheduler.exe

uRun: [lMmikoMOHSe] c:\documents and settings\all users\application data\lMmikoMOHSe.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRunOnce: [shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.epcomm.com/center/point/point.htm"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [<NO NAME>]

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"

mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"

mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [D-Link RangeBooster G WDA-2320] c:\program files\d-link\rangebooster g wda-2320\AirPlusCFG.exe

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe

mRun: [indexSearch] c:\program files\scansoft\paperport\IndexSearch.exe

mRun: [EverioService] "c:\program files\cyberlink\pcm4everio\EverioService.exe"

mRun: [FixCamera] c:\windows\FixCamera.exe

mRun: [tsnp2std] c:\windows\tsnp2std.exe

mRun: [snp2std] c:\windows\vsnp2std.exe

mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe

mRun: [HPHUPD05] c:\program files\hewlett-packard\\{5372b9a6-6e51-4f90-9b40-e0a3b8475c4e}\hphupd05.exe

mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"

mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe"

mRun: [HPHmon05] c:\windows\system32\hphmon05.exe

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\mama\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office12\OUTLOOK.EXE

mPolicies-system: HideFastUserSwitching = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab

DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - hxxp://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}

DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - hxxp://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{92AB4FFA-1310-438B-A9DE-1E1362034604} : DhcpNameServer = 192.168.1.1

Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\windows\system32\kbdhe31932.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

.

============= SERVICES / DRIVERS ===============

.

R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2008-4-30 4064]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]

R1 MpKsl451319bd;MpKsl451319bd;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{be175433-934d-4da7-a73e-8b95af326ca0}\MpKsl451319bd.sys [2011-6-13 28752]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\adobe\elements organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-18 169312]

R2 PermissionTVDownloadManager;PermissionTV Download Manager Service;c:\progra~1\permis~1\bin\dm.exe [2008-7-18 213053]

R2 seclogon32;Secondary Logon ;c:\windows\system32\qcap32.exe [2011-6-9 785920]

R3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [2008-3-29 15104]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-2 135664]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-7 366640]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2006-10-15 472832]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-2 135664]

S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-7 39984]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]

.

=============== Created Last 30 ================

.

2011-06-13 14:21:42 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{be175433-934d-4da7-a73e-8b95af326ca0}\MpKsl451319bd.sys

2011-06-10 17:01:10 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-10 03:17:44 785920 ----a-w- c:\windows\system32\d3dim70032.exe

2011-06-10 03:17:44 168960 ----a-w- c:\windows\system32\kbdhe31932.dll

2011-06-10 03:17:43 785920 ----a-w- c:\windows\system32\qcap32.exe

2011-06-10 03:17:38 785920 ----a-w- c:\documents and settings\mama\0.6626176752707312.exe

2011-06-09 00:07:44 -------- d-----w- c:\documents and settings\mama\application data\SUPERAntiSpyware.com

2011-06-09 00:07:44 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com

2011-06-09 00:07:36 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-06-08 23:42:33 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2011-06-08 23:42:07 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{be175433-934d-4da7-a73e-8b95af326ca0}\mpengine.dll

2011-06-08 22:22:21 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-08 22:22:21 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-06-08 15:41:54 -------- d-----w- c:\documents and settings\mama\application data\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1

2011-06-08 15:32:02 -------- d-----w- c:\program files\New Folder

2011-06-08 01:22:57 -------- d-----w- c:\documents and settings\mama\application data\Malwarebytes

2011-06-08 01:22:52 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-08 01:22:52 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-06-08 01:22:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-07 18:41:59 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-07 18:38:27 -------- d-----w- c:\program files\Microsoft Security Client

.

==================== Find3M ====================

.

2011-04-09 18:39:30 7734208 ----a-w- C:\mbam-setup.exe

.

============= FINISH: 10:29:27.95 ===============

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6847

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/13/2011 10:04:32 AM

mbam-log-2011-06-13 (10-04-32).txt

Scan type: Quick scan

Objects scanned: 225597

Time elapsed: 21 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 5

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 10

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\system32\atmlib32.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{02377D76-353C-47E0-B40E-13AD8DF25BC6} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02377D76-353C-47E0-B40E-13AD8DF25BC6} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{02377D76-353C-47E0-B40E-13AD8DF25BC6} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{02377D76-353C-47E0-B40E-13AD8DF25BC6} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\Mama\0.2363767376032323.exe (Trojan.Tracur.Wow) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000db6d23c91270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000db6d23c91270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000db6d23c91270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000db6d23c91270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000db6d23c91270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000db6d23c91270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000db6d23c91270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000db6d23c91270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\atmlib32.dll (Trojan.Agent) -> Delete on reboot.

LakeOrion · June 14, 2011

Being new to this board, having just purchased Malwarebytes, I need to ask...have I done something wrong?

No one has replied to my original post, whereas I see others with the "Google Re-Direct" virus have been answered and been given further instructions on how to rid their computers of this malady.

If there is something I need to do or did incorrectly the first time around, please let me know.

Thanks very much!

- Andy

LDTate · June 14, 2011

Logs will be closed if you haven't replied within 3 days

We look for post with 0 replies, so when you posted to your own log, we assumed you were being helped.

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\windows\system32\kbdhe31932.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

LakeOrion · June 14, 2011

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: kbdhe31932.dll

Submission date: 2011-06-14 20:00:03 (UTC)

Current status: queued queued (#32) analysing finished

Result: 1/ 42 (2.4%)

VT Community

not reviewed

Safety score: -

Compact Print results Antivirus Version Last Update Result

AhnLab-V3 2011.06.15.00 2011.06.14 -

AntiVir 7.11.9.197 2011.06.14 -

Antiy-AVL 2.0.3.7 2011.06.14 -

Avast 4.8.1351.0 2011.06.14 -

Avast5 5.0.677.0 2011.06.14 -

AVG 10.0.0.1190 2011.06.14 -

BitDefender 7.2 2011.06.14 -

CAT-QuickHeal 11.00 2011.06.14 -

ClamAV 0.97.0.0 2011.06.14 -

Commtouch 5.3.2.6 2011.06.14 -

Comodo 9068 2011.06.14 -

DrWeb 5.0.2.03300 2011.06.14 -

eSafe 7.0.17.0 2011.06.14 -

eTrust-Vet 36.1.8386 2011.06.14 -

F-Prot 4.6.2.117 2011.06.14 -

F-Secure 9.0.16440.0 2011.06.14 -

Fortinet 4.2.257.0 2011.06.14 -

GData 22 2011.06.14 -

Ikarus T3.1.1.104.0 2011.06.14 -

Jiangmin 13.0.900 2011.06.14 -

K7AntiVirus 9.106.4812 2011.06.14 -

Kaspersky 9.0.0.837 2011.06.14 -

McAfee 5.400.0.1158 2011.06.14 -

McAfee-GW-Edition 2010.1D 2011.06.14 -

Microsoft 1.6903 2011.06.13 -

NOD32 6208 2011.06.14 -

Norman 6.07.10 2011.06.14 -

nProtect 2011-06-14.01 2011.06.14 -

Panda 10.0.3.5 2011.06.14 -

PCTools 7.0.3.5 2011.06.14 -

Prevx 3.0 2011.06.14 -

Rising 23.62.01.03 2011.06.14 -

Sophos 4.66.0 2011.06.14 Troj/Bckdr-RHT

SUPERAntiSpyware 4.40.0.1006 2011.06.14 -

Symantec 20111.1.0.186 2011.06.14 -

TheHacker 6.7.0.1.230 2011.06.14 -

TrendMicro 9.200.0.1012 2011.06.14 -

TrendMicro-HouseCall 9.200.0.1012 2011.06.14 -

VBA32 3.12.16.1 2011.06.14 -

VIPRE 9583 2011.06.14 -

ViRobot 2011.6.14.4511 2011.06.14 -

VirusBuster 14.0.80.1 2011.06.14 -

Additional informationShow all

MD5 : a82c18dc0142deeaf9fffc9c12d627f3

SHA1 : a7b2ba3c35b1e323b2e63fa4f52528318bdd7f61

SHA256: 04ec837c175ff6617ab01bfc2467e138378cc8f5544f216e024bc97300d63f11

ssdeep: 3072:ma6v/UxHib7CjBVYsb84pIKB/mY+rhWzpLcS9Fz01y/BCtPjhMb5:mvUB67CFBb8uIumhh

VS9FL/BEjh

File size : 168960 bytes

First seen: 2011-06-10 02:48:01

Last seen : 2011-06-14 20:00:03

TrID:

Win32 Executable MS Visual C++ (generic) (65.1%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

sigcheck:

publisher....: n/a

product......: Dr Link Library

description..: Dr Link Library

original name: Dr.DLL

internal name: Dr

file version.: 2009, 11, 12, 115

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

PEInfo: PE structure information

[[ basic data ]]

entrypointaddress: 0x8C94

timedatestamp....: 0x43AE09BD (Sun Dec 25 02:53:49 2005)

machinetype......: 0x14c (I386)

[[ 8 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x1000, 0xA000, 0x9600, 5.82, 8b5a1f7b0cd58c6f361797dfdbc9c811

.data, 0xB000, 0xF000, 0xF000, 7.50, 346c1af89beefe2c3d936473abd5d880

.rdata, 0x1A000, 0xF000, 0xEE00, 7.47, d42962281eec260728fef0c8a5a211da

.bss, 0x29000, 0x4000, 0x0, 0.00, d41d8cd98f00b204e9800998ecf8427e

.edata, 0x2D000, 0x1000, 0x200, 4.05, 2c8484b20bf40a859b69083710f940e6

.idata, 0x2E000, 0x1000, 0x600, 4.78, e8338ef2d73ffe929d0f5fccbdb8a1c4

.rsrc, 0x2F000, 0x1000, 0x400, 2.59, bf731159fd6855cce424708e422fafb4

.reloc, 0x30000, 0xF71, 0x1000, 6.71, cd4934617a9c99a4e5bb9ee304f3a742

[[ 6 import(s) ]]

ADVAPI32.dll: OpenTraceW, RegDeleteKeyA, SetPrivateObjectSecurityEx, ChangeServiceConfig2W

KERNEL32.dll: DeleteFileA, DeviceIoControl, ExitProcess, GetModuleHandleA, GetProcAddress, HeapSize, LoadLibraryA, VirtualAlloc, VirtualFree

ole32.dll: StringFromGUID2, CLSIDFromString, CoBuildVersion, CoFileTimeNow, IsEqualGUID, CreateAntiMoniker

USER32.dll: RegisterHotKey, CharNextA, EnumDesktopsA, GetClassWord, GetClipboardFormatNameA, GetKBCodePage, GetPriorityClipboardFormat, IsCharAlphaA, IsClipboardFormatAvailable, MessageBoxExA, MessageBoxIndirectA, PeekMessageA, CloseWindowStation, SendMessageTimeoutW, SetClipboardViewer

security.dll: DeleteSecurityPackageW, FreeCredentialsHandle

MSVCRT.dll: exit, _cexit, __set_app_type, __p__commode, __getmainargs

[[ 9 export(s) ]]

CompressedFileReaderObjectCreate, CompressedFileReaderObjectUncompressedSizeGet, Create, DeviceAddLocal, DiscAtOnceRawPWFromFileAudioUnicode, FileCreate, ISO9660JolietFileTreeImportTrack, TestUnitReadyEx, TrackAtOnceFromMemory

ExifTool:

file metadata

CharacterSet: Unicode

CodeSize: 40960

EntryPoint: 0x8c94

FileDescription: Dr Link Library

FileFlagsMask: 0x0017

FileOS: Win32

FileSize: 165 kB

FileSubtype: 0

FileType: Win32 DLL

FileVersion: 2009, 11, 12, 115

FileVersionNumber: 2009.11.12.115

ImageVersion: 1.0

InitializedDataSize: 180224

InternalName: Dr

LanguageCode: Process default

LinkerVersion: 2.38

MIMEType: application/octet-stream

MachineType: Intel 386 or later, and compatibles

OSVersion: 4.0

ObjectFileType: Dynamic link library

OriginalFilename: Dr.DLL

PEType: PE32

ProductName: Dr Link Library

ProductVersion: 1, 0, 0, 115

ProductVersionNumber: 1.0.0.115

Subsystem: Windows GUI

SubsystemVersion: 4.0

TimeStamp: 2005:12:25 03:53:49+01:00

UninitializedDataSize: 16384

Symantec reputation:Suspicious.Insight

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

LDTate · June 14, 2011

2011-06-10 03:17:44 785920 ----a-w- c:\windows\system32\d3dim70032.exe

2011-06-10 03:17:44 168960 ----a-w- c:\windows\system32\kbdhe31932.dll

2011-06-10 03:17:43 785920 ----a-w- c:\windows\system32\qcap32.exe

2011-06-10 03:17:38 785920 ----a-w- c:\documents and settings\mama\0.6626176752707312.exe

I believe all 4 of the above are bad.

There are 3 with the exact same size and date

Use Joltti's again and submit this one.

c:\windows\system32\d3dim70032.exe

LakeOrion · June 14, 2011

Lots of hits...what a mess!

- Andy

Antivirus Version Last Update Result

AhnLab-V3 2011.06.15.00 2011.06.14 -

AntiVir 7.11.9.197 2011.06.14 TR/Kazy.26487.3

Antiy-AVL 2.0.3.7 2011.06.14 -

Avast 4.8.1351.0 2011.06.14 Win32:Downloader-HUV

Avast5 5.0.677.0 2011.06.14 Win32:Downloader-HUV

AVG 10.0.0.1190 2011.06.14 SHeur3.CEDL

BitDefender 7.2 2011.06.14 Gen:Variant.Kazy.26487

CAT-QuickHeal 11.00 2011.06.14 -

ClamAV 0.97.0.0 2011.06.14 -

Commtouch 5.3.2.6 2011.06.14 -

Comodo 9068 2011.06.14 Heur.Suspicious

DrWeb 5.0.2.03300 2011.06.14 Trojan.Bender.210

eSafe 7.0.17.0 2011.06.14 -

eTrust-Vet 36.1.8386 2011.06.14 -

F-Prot 4.6.2.117 2011.06.14 -

F-Secure 9.0.16440.0 2011.06.14 Gen:Variant.Kazy.26487

Fortinet 4.2.257.0 2011.06.14 W32/Bckdr.RHS!tr

GData 22 2011.06.14 Gen:Variant.Kazy.26487

Ikarus T3.1.1.104.0 2011.06.14 -

Jiangmin 13.0.900 2011.06.14 -

K7AntiVirus 9.106.4812 2011.06.14 -

Kaspersky 9.0.0.837 2011.06.14 HEUR:Trojan.Win32.Generic

McAfee 5.400.0.1158 2011.06.14 Generic.bfr!ce

McAfee-GW-Edition 2010.1D 2011.06.14 Generic.bfr!ce

Microsoft 1.6903 2011.06.13 -

NOD32 6208 2011.06.14 a variant of Win32/Kryptik.OYY

Norman 6.07.10 2011.06.14 -

nProtect 2011-06-14.01 2011.06.14 Gen:Variant.Kazy.26487

Panda 10.0.3.5 2011.06.14 -

PCTools 7.0.3.5 2011.06.14 Trojan.Gen

Prevx 3.0 2011.06.14 -

Rising 23.62.01.03 2011.06.14 -

Sophos 4.66.0 2011.06.14 Troj/Bckdr-RHS

SUPERAntiSpyware 4.40.0.1006 2011.06.14 -

Symantec 20111.1.0.186 2011.06.14 -

TheHacker 6.7.0.1.230 2011.06.14 -

TrendMicro 9.200.0.1012 2011.06.14 -

TrendMicro-HouseCall 9.200.0.1012 2011.06.14 -

VBA32 3.12.16.1 2011.06.14 -

VIPRE 9583 2011.06.14 Trojan.Win32.Generic!BT

ViRobot 2011.6.14.4511 2011.06.14 -

VirusBuster 14.0.80.1 2011.06.14 -

LDTate · June 14, 2011

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

LakeOrion · June 14, 2011

Larry -

The log is below.

I did several Google searches, and it did not redirect me...it looks like it may be fixed!

I look forward to your reply!

- Andy

ComboFix 11-06-14.01 - Mama 06/14/2011 18:51:30.1.4 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3061.2276 [GMT -4:00]

Running from: c:\documents and settings\Mama\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Mama\0.6626176752707312.exe

c:\documents and settings\Mama\WINDOWS

C:\Install.exe

C:\Thumbs.db

c:\windows\jestertb.dll

c:\windows\system32\twain.dll

.

Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2011-05-14 to 2011-06-14 )))))))))))))))))))))))))))))))

.

2011-06-13 21:22 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\atmlib32.exe

2011-06-13 21:21 . 2011-06-13 21:21 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE175433-934D-4DA7-A73E-8B95AF326CA0}\MpKsl5a1754b1.sys

2011-06-13 20:51 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\cryptdlg32.exe

2011-06-13 14:21 . 2011-06-13 14:21 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE175433-934D-4DA7-A73E-8B95AF326CA0}\MpKsl451319bd.sys

2011-06-10 17:01 . 2011-06-10 17:01 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-10 03:17 . 2011-06-10 03:17 168960 ----a-w- c:\windows\system32\kbdhe31932.dll

2011-06-10 03:17 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\d3dim70032.exe

2011-06-10 03:17 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\qcap32.exe

2011-06-09 00:07 . 2011-06-09 00:07 -------- d-----w- c:\documents and settings\Mama\Application Data\SUPERAntiSpyware.com

2011-06-09 00:07 . 2011-06-09 00:07 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-06-09 00:07 . 2011-06-09 00:08 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-06-08 23:42 . 2011-05-09 17:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-06-08 23:42 . 2011-05-09 17:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE175433-934D-4DA7-A73E-8B95AF326CA0}\mpengine.dll

2011-06-08 22:22 . 2011-06-08 23:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-06-08 22:22 . 2011-06-08 22:24 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-08 15:41 . 2011-06-08 15:41 -------- d-----w- c:\documents and settings\Mama\Application Data\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1

2011-06-08 15:32 . 2011-06-08 15:32 -------- d-----w- c:\program files\New Folder

2011-06-08 01:22 . 2011-06-08 01:22 -------- d-----w- c:\documents and settings\Mama\Application Data\Malwarebytes

2011-06-08 01:22 . 2011-06-08 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-06-08 01:22 . 2011-05-29 13:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-08 01:22 . 2011-06-08 01:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-07 18:41 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-07 18:38 . 2011-06-07 18:40 -------- d-----w- c:\program files\Microsoft Security Client

2011-06-07 04:55 . 2011-06-07 04:55 -------- d-----w- c:\documents and settings\Megan\Application Data\Malwarebytes

2011-06-07 03:13 . 2011-06-07 03:13 -------- d-----w- c:\documents and settings\Andy\Application Data\Malwarebytes

2011-06-06 22:33 . 2011-06-06 22:33 -------- d-sh--w- c:\documents and settings\Megan\PrivacIE

2011-06-06 22:31 . 2011-06-06 22:31 -------- d-sh--w- c:\documents and settings\Megan\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-09 18:39 . 2011-04-09 18:39 7734208 ----a-w- C:\mbam-setup.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D594D5CF-32C9-35D8-5C9E-63669AB3FB5F}]

2011-06-10 03:17 168960 ----a-w- c:\windows\system32\kbdhe31932.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-11-06 4347120]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-20 68856]

"HLBackupScheduler"="c:\program files\Verizon V CAST Media Manager\V CAST Backup Scheduler.exe" [2010-12-08 5247624]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-23 2424192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-17 142104]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-17 162584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-17 138008]

"RTHDCPL"="RTHDCPL.EXE" [2007-07-17 16132608]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]

"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

"D-Link RangeBooster G WDA-2320"="c:\program files\D-Link\RangeBooster G WDA-2320\AirPlusCFG.exe" [2006-11-16 1880064]

"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2006-06-29 49152]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2003-09-06 57393]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2003-09-06 40960]

"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-01 151552]

"FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480]

"tsnp2std"="c:\windows\tsnp2std.exe" [2007-08-31 262144]

"snp2std"="c:\windows\vsnp2std.exe" [2007-08-07 348160]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2005-07-08 176128]

"HPHUPD05"="c:\program files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2005-07-08 49152]

"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]

"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2003-12-05 49152]

"HPHmon05"="c:\windows\system32\hphmon05.exe" [2005-07-08 491520]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-11 202256]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\documents and settings\Mama\Start Menu\Programs\Startup\

Microsoft Outlook.lnk - c:\program files\Microsoft Office\Office12\OUTLOOK.EXE [2011-4-22 12993904]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"HideFastUserSwitching"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\kbdhe31932.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=

"c:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=

"c:\\Program Files\\CyberLink\\PowerDirector Express\\PDX.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Akrontech\\enuff\\enuff.exe"=

"c:\\Program Files\\Akrontech\\enuff\\enuffcfg.exe"=

"c:\\Program Files\\Akrontech\\enuff\\enserv.exe"=

"c:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\qcap32.exe"=

"c:\\WINDOWS\\system32\\atmlib32.exe"=

.

R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [4/30/2008 9:41 PM 4064]

R1 MpKsl451319bd;MpKsl451319bd;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE175433-934D-4DA7-A73E-8B95AF326CA0}\MpKsl451319bd.sys [6/13/2011 10:21 AM 28752]

R1 MpKsl5a1754b1;MpKsl5a1754b1;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BE175433-934D-4DA7-A73E-8B95AF326CA0}\MpKsl5a1754b1.sys [6/13/2011 5:21 PM 28752]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]

R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [9/18/2009 5:54 AM 169312]

R2 PermissionTVDownloadManager;PermissionTV Download Manager Service;c:\progra~1\PERMIS~1\bin\dm.exe [7/18/2008 3:50 PM 213053]

R2 ProtectedStorage32;Protected Storage ;c:\windows\system32\atmlib32.exe [6/13/2011 5:22 PM 785920]

R2 seclogon32;Secondary Logon ;c:\windows\system32\qcap32.exe [6/9/2011 11:17 PM 785920]

R2 WSearch32;Windows Search ;c:\windows\system32\cryptdlg32.exe [6/13/2011 4:51 PM 785920]

R3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [3/29/2008 7:50 PM 15104]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2010 9:56 PM 135664]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/7/2011 9:22 PM 366640]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [10/15/2006 11:58 PM 472832]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2010 9:56 PM 135664]

S3 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/7/2011 9:22 PM 39984]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 4:22 PM 34064]

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-10 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

.

2011-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 01:56]

.

2011-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 01:56]

.

2011-06-14 c:\windows\Tasks\HP Usg Daily.job

- c:\program files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe [2009-05-30 04:55]

.

2011-06-14 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 16:26]

.

2011-06-14 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2507298523-669678856-1538595869-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2507298523-669678856-1538595869-1008.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2507298523-669678856-1538595869-1009.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2507298523-669678856-1538595869-1006.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2507298523-669678856-1538595869-1008.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2507298523-669678856-1538595869-1009.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

2011-06-14 c:\windows\Tasks\User_Feed_Synchronization-{F1D71C65-DECE-4568-A026-8AE8004B7388}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.weather.com/weather/today/48362

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

HKCU-Run-lMmikoMOHSe - c:\documents and settings\All Users\Application Data\lMmikoMOHSe.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-14 19:00

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(768)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

Completion time: 2011-06-14 19:03:17

ComboFix-quarantined-files.txt 2011-06-14 23:03

.

Pre-Run: 11,666,485,248 bytes free

Post-Run: 12,423,401,472 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 1AFA7EDCED4E8CCF1F7E808957B9B1F1

LDTate · June 14, 2011

We need to get copies of these new bad guys

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.malwarebytes.org/index.php?showtopic=87173

Collect::
c:\windows\system32\atmlib32.exe
c:\windows\system32\cryptdlg32.exe
c:\windows\system32\kbdhe31932.dll
c:\windows\system32\d3dim70032.exe
c:\windows\system32\qcap32.exe

Driver::
ProtectedStorage32
seclogon32
WSearch32

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D594D5CF-32C9-35D8-5C9E-63669AB3FB5F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

LakeOrion · June 15, 2011

Larry -

Here is the requested log.

Everything seems to be fine...anything else I need to do (like turn on my CD emulation again)?

- Andy

ComboFix 11-06-14.01 - Mama 06/14/2011 21:15:23.2.4 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3061.2369 [GMT -4:00]

Running from: c:\documents and settings\Mama\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Mama\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

file zipped: c:\windows\system32\atmlib32.exe

file zipped: c:\windows\system32\cryptdlg32.exe

file zipped: c:\windows\system32\d3dim70032.exe

file zipped: c:\windows\system32\kbdhe31932.dll

file zipped: c:\windows\system32\qcap32.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\Application Data\02000000db6d23c91270C.manifest

c:\documents and settings\LocalService\Application Data\02000000db6d23c91270O.manifest

c:\documents and settings\LocalService\Application Data\02000000db6d23c91270P.manifest

c:\documents and settings\LocalService\Application Data\02000000db6d23c91270S.manifest

c:\windows\system32\atmlib32.exe

c:\windows\system32\cryptdlg32.exe

c:\windows\system32\d3dim70032.exe

c:\windows\system32\kbdhe31932.dll

c:\windows\system32\qcap32.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PROTECTEDSTORAGE32

-------\Legacy_SECLOGON32

-------\Legacy_WSEARCH32

-------\Service_ProtectedStorage32

-------\Service_seclogon32

-------\Service_WSearch32

.

((((((((((((((((((((((((( Files Created from 2011-05-15 to 2011-06-15 )))))))))))))))))))))))))))))))

.

2011-06-15 01:31 . 2011-06-15 01:31 168960 ----a-w- c:\windows\system32\atmlib32.dll

2011-06-15 01:29 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\davclnt32.exe

2011-06-15 01:29 . 2011-06-10 03:17 785920 ----a-w- c:\windows\system32\kbdhela232.exe

2011-06-14 23:04 . 2011-05-09 17:46 6962000 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{17BBAFCB-2FEB-417D-9E91-51D6A884035A}\mpengine.dll