Google redirect and fsharproj

irritated2011 · June 21, 2011

Last Wednesday I "acquired" a Google redirect virus. This or something else seems to have loaded a lot of nasty stuff onto my computer, including something that blocked Avira from being updated. I normally run Avira constantly and run Malware Bytes frequently when I think I've been exposed. Unfortunately I did the stupid thing of turning Avira off because I thought it was making the computer really slow. I ran defogger on Thursday and have left CD emulation disabled. I have finally been able to update Avira (by removing it with the control panel, running an Avira key cleaner, and doing a fresh install). Since reloading Avira (a newer version) it has been periodically blocking attempts to access file D:\Autorun.inf. My D: partition was created by HP and only contains a copy of the operating system.

After running both Malwarebytes and Avira repeatedly and alternately I have finally achieved a clean Avira scan and a nearly clean Malwarebytes scan - it still shows fsharproj and it either fails to remove it, or it gets reloaded right away. I still have the Google redirect problem, but I stopped using it and removed it as my home page.

So I need to fix the redirect problem plus whatever is making fsharproj persist.

I've attached the requested logs, but after running GMER for many, many hours my computer rebooted itself and ran chkdsk - losing the file. I'm not sure what kind of problem caused that.

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6899

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/20/2011 11:47:14 AM

mbam-log-2011-06-20 (11-47-14).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 377754

Time elapsed: 7 hour(s), 44 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

Run by Owner at 12:51:05 on 2011-06-20

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.158 [GMT -7:00]

.

AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Yahoo!\browser\ybrwicon.exe

C:\WINDOWS\system32\VTTimer.exe

C:\HP\KBD\KBD.EXE

C:\windows\system\hpsysdrv.exe

C:\WINDOWS\System32\hphmon05.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uSearch Bar =

uInternet Connection Wizard,ShellNext = hxxp://yahoo.sbc.com/dsl

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: {014f2dca-54a8-4544-8766-9c98a03a343f} - c:\windows\system32\Audio3D32.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: 3033dba9: {1d4be1cf-7ea5-a953-5c94-a43862a54cf4} - c:\windows\system32\ialmrnt532.dll

BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - No File

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {C7768536-96F8-4001-B1A2-90EE21279187} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: hp view: {8f4902b6-6c04-4ade-8052-aa58578a21bd} - c:\windows\system32\Shdocvw.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [YBrowser] c:\program files\yahoo!\browser\ybrwicon.exe

mRun: [VTTimer] VTTimer.exe

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [updateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r

mRun: [Reminder] "c:\windows\creator\Remind_XP.exe"

mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE

mRun: [PS2] c:\windows\system32\ps2.exe

mRun: [PRISMSVR.EXE] "c:\windows\system32\PRISMSVR.EXE" /APPLY

mRun: [KBD] c:\hp\kbd\KBD.EXE

mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe

mRun: [HPHmon05] c:\windows\system32\hphmon05.exe

mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [AlcxMonitor] ALCXMNTR.EXE

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

IE: Add To HP Organize... - c:\progra~1\hewlet~1\hporga~1\bin\core.hp.main\SendTo.html

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\owner\start menu\programs\imvu\Run IMVU.lnk

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

Trusted Zone: ameritrade.com

Trusted Zone: tdameritrade.com

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab

DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab

DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - hxxp://launch.gamespyarcade.com/software/launch/alaunch.cab

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab

DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - hxxp://download.yahoo.com/dl/installs/ymail/ymmapi.dll

DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx

DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {D821DC4A-0814-435E-9820-661C543A4679} - hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{B2EEDFB1-1EF7-44DD-8F85-306238AD1952} : DhcpNameServer = 192.168.1.254

Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll

Notify: igfxcui - igfxsrvc.dll

Notify: WRNotifier - WRLogonNTF.dll

AppInit_DLLs: c:\windows\system32\ialmrnt532.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\ntdc9exx.default\

FF - prefs.js: browser.startup.homepage - yahoo.com

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

FF - Ext: StumbleUpon: {AE93811A-5C9A-4d34-8462-F7B864FC4696} - %profile%\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}

FF - Ext: Adblock: {34274bf4-1d97-a289-e984-17e546307e4f} - %profile%\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: IE Tab: {77b819fa-95ad-4f2c-ac7c-486b356188a9} - %profile%\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: XUL Cache: {5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85} - %profile%\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}

FF - Ext: XUL Cache: {c975d69b-e210-42b7-8a5f-8608722e8308} - %profile%\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}

FF - Ext: XUL Cache: {d0bcf974-8ea8-4ac6-8023-304c7ed641dd} - %profile%\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}

FF - Ext: XUL Cache: {ed16464e-0040-4e7a-beb3-bf8b3ddefcf2} - %profile%\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}

FF - Ext: XUL Cache: {8c6c368f-56a9-469e-9bb9-998825f424c8} - %profile%\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}

FF - Ext: XUL Cache: {e447c891-0f34-46b9-9d3f-ba7281df68fe} - %profile%\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}

FF - Ext: XUL Cache: {2b747b40-3541-447d-99a1-54a43eb308a9} - %profile%\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}

FF - Ext: XUL Cache: {47e7afaa-e0ac-4478-acbb-357913237b1a} - %profile%\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}

FF - Ext: XUL Cache: {504a38b5-1a04-41b3-bc96-c53e4f2e37ca} - %profile%\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}

FF - Ext: XUL Cache: {43467305-1718-458f-9a8c-2dcac370f6d5} - %profile%\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}

FF - Ext: XUL Cache: {5d069a26-f1db-4a26-adb1-094ee03e9ea5} - %profile%\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

.

============= SERVICES / DRIVERS ===============

.

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-6-17 11608]

R1 EPPSCSIx;EPPSCSIx;c:\windows\system32\drivers\EPPSCSI.SYS [2004-12-16 49628]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-6-17 136360]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-6-17 269480]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-6-17 61960]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-10-13 136176]

S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera;c:\windows\system32\drivers\ubVeo532.sys [2002-7-1 95232]

S3 EPUSBSTOR;EPSON USB Storage Driver;c:\windows\system32\drivers\epusbsto.sys [2004-11-20 17976]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-10-13 136176]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-8-9 39984]

.

=============== File Associations ===============

.

regfile=regedit.exe "%1" %*

.

=============== Created Last 30 ================

.

2011-06-18 04:24:37 -------- d-----w- c:\documents and settings\owner\application data\Avira

2011-06-18 04:11:31 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-18 04:10:52 -------- d-----w- c:\program files\Avira

2011-06-18 04:10:52 -------- d-----w- c:\documents and settings\all users\application data\Avira

2011-06-18 03:46:00 -------- d-----w- C:\f4ee5476ce7ade7fe1ed707ca5

2011-06-15 04:42:35 0 ---ha-w- c:\documents and settings\owner\ixgketsqzg.tmp

2011-06-14 21:16:15 -------- d-----w- c:\windows\system32\NtmsData

2011-06-13 09:51:26 167936 ----a-w- c:\windows\system32\ialmrnt532.dll

2011-06-13 09:50:35 365056 ----a-w- c:\windows\system32\Audio3D32.dll

.

==================== Find3M ====================

.

2011-05-29 16:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-29 16:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll

2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-25 16:11:11 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec

2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys

1998-12-09 02:53:54 99840 ----a-w- c:\program files\common files\IRAABOUT.DLL

1998-12-09 02:53:54 70144 ----a-w- c:\program files\common files\IRAMDMTR.DLL

1998-12-09 02:53:54 48640 ----a-w- c:\program files\common files\IRALPTTR.DLL

1998-12-09 02:53:54 31744 ----a-w- c:\program files\common files\IRAWEBTR.DLL

1998-12-09 02:53:54 186368 ----a-w- c:\program files\common files\IRAREG.DLL

1998-12-09 02:53:54 17920 ----a-w- c:\program files\common files\IRASRIAL.DLL

.

============= FINISH: 12:54:09.01 ===============

attach.zip

Elise · June 22, 2011

Hi and :welcome:

That looks like some bad Firefox extensions.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

irritated2011 · June 23, 2011

Thanks, Elise - I was beginning to feel overlooked...

I ran combofix - It sure seems to do a lot of stuff. I haven't checked to see if my original problems are gone yet, but Internet Explorer didn't want to open, although Mozella opened right up. IE finally opened on the third try.

Thanks for your help - it looks like my computer had a lot of garbage on it, in spite of running two different virus programs. Doug

Here is the log:

ComboFix 11-06-22.02 - Owner 06/22/2011 22:40:52.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.136 [GMT -7:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\Default User\WINDOWS

c:\documents and settings\Owner\Application Data\Microsoft\~DFK1dc1551.tmp

c:\documents and settings\Owner\Application Data\Microsoft\1eaadjc.dll

c:\documents and settings\Owner\Application Data\Microsoft\bass.dll

c:\documents and settings\Owner\Application Data\Microsoft\kfgresk.dll

c:\documents and settings\Owner\Application Data\Microsoft\mjcriu.dll

c:\documents and settings\Owner\Application Data\Microsoft\peaadje.dll

c:\documents and settings\Owner\Application Data\Microsoft\qwadjb.dll

c:\documents and settings\Owner\Application Data\Microsoft\rsaadjd.dll

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{1d3ba1a6-5777-49ad-8b95-1dac137eec86}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{1d3ba1a6-5777-49ad-8b95-1dac137eec86}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{1d3ba1a6-5777-49ad-8b95-1dac137eec86}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{1d3ba1a6-5777-49ad-8b95-1dac137eec86}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{1d3ba1a6-5777-49ad-8b95-1dac137eec86}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{2b747b40-3541-447d-99a1-54a43eb308a9}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{43467305-1718-458f-9a8c-2dcac370f6d5}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{47e7afaa-e0ac-4478-acbb-357913237b1a}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{504a38b5-1a04-41b3-bc96-c53e4f2e37ca}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5d069a26-f1db-4a26-adb1-094ee03e9ea5}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{5dd9dc6d-18cc-4c3f-bbd4-16c8eed5cc85}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{8c6c368f-56a9-469e-9bb9-998825f424c8}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{c975d69b-e210-42b7-8a5f-8608722e8308}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{d0bcf974-8ea8-4ac6-8023-304c7ed641dd}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{e447c891-0f34-46b9-9d3f-ba7281df68fe}\install.rdf

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{ed16464e-0040-4e7a-beb3-bf8b3ddefcf2}\install.rdf

c:\documents and settings\Owner\jaudioMp3Win.tar

c:\documents and settings\Owner\Local Settings\Temporary Internet Files\mcc3C.tmp

c:\documents and settings\Owner\RedSwoosh-2.115-115.dll

c:\documents and settings\Owner\WINDOWS

c:\program files\CleanUp

c:\program files\CleanUp\Help\English.Resident.chm

c:\program files\CleanUp\HijackThis\HijackThis.exe

c:\program files\CleanUp\Includes\Adware.sbi

c:\program files\CleanUp\Includes\AdwareC.sbi

c:\program files\CleanUp\Includes\DialerC.sbi

c:\program files\CleanUp\Includes\HeavyDuty.sbi

c:\program files\CleanUp\Includes\HijackersC.sbi

c:\program files\CleanUp\Includes\KeyloggersC.sbi

c:\program files\CleanUp\Includes\MalwareC.sbi

c:\program files\CleanUp\Includes\PUPS.sbi

c:\program files\CleanUp\Includes\PUPSC.sbi

c:\program files\CleanUp\Includes\SecurityC.sbi

c:\program files\CleanUp\Includes\Services.sbs

c:\program files\CleanUp\Includes\SpybotsC.sbi

c:\program files\CleanUp\Includes\Spyware.sbi

c:\program files\CleanUp\Includes\SpywareC.sbi

c:\program files\CleanUp\Includes\TrojansC.sbi

c:\program files\CleanUp\Plugins\TCPIPAddress.dll

c:\program files\CleanUp\Updates\advcheck.zip

c:\program files\CleanUp\Updates\clsid.zip

c:\program files\CleanUp\Updates\help.english.zip

c:\program files\CleanUp\Updates\helpres.english.zip

c:\program files\CleanUp\Updates\includes.zip

c:\program files\CleanUp\Updates\lang.english.zip

c:\program files\CleanUp\Updates\mainapp160.zip

c:\program files\CleanUp\Updates\online.ini

c:\program files\CleanUp\Updates\plugtcpip.zip

c:\program files\CleanUp\Updates\sbsd160upd.exe

c:\program files\CleanUp\Updates\startup.zip

c:\windows\system32\config\systemprofile\WINDOWS

c:\windows\system32\klnmp.bak1

c:\windows\system32\klnmp.bak2

c:\windows\system32\klnmp.ini

c:\windows\system32\klnmp.tmp

D:\Autorun.inf

.

----- BITS: Possible infected sites -----

.

hxxp://au.downloj+|Cv+@J:NGD_DQ{zcxLJS@5dBt+fj.WU Client DownloadS-1-5-18`HT4?? 6VwoQZCDHMs

hxxp://a

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ZESOFT

.

((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))

.

2011-06-23 02:17 . 2011-06-23 02:17 -------- d-----w- C:\7dea6ba6796f9aaaffcde647872d

2011-06-22 04:46 . 2011-06-22 04:46 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG10

2011-06-22 04:40 . 2011-06-22 04:40 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files

2011-06-22 04:30 . 2011-06-23 05:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10

2011-06-22 04:27 . 2011-06-22 04:27 -------- d-----w- c:\program files\AVG

2011-06-22 04:16 . 2011-06-23 05:25 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData

2011-06-18 04:24 . 2011-06-18 04:24 -------- d-----w- c:\documents and settings\Owner\Application Data\Avira

2011-06-18 04:11 . 2011-04-02 00:07 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-06-18 04:11 . 2011-04-02 00:07 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-06-18 04:11 . 2010-06-17 22:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2011-06-18 04:11 . 2010-06-17 22:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2011-06-18 04:10 . 2011-06-18 04:10 -------- d-----w- c:\program files\Avira

2011-06-18 04:10 . 2011-06-18 04:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2011-06-18 03:46 . 2011-06-18 03:46 -------- d-----w- C:\f4ee5476ce7ade7fe1ed707ca5

2011-06-15 04:42 . 2011-06-15 04:42 0 ---ha-w- c:\documents and settings\Owner\ixgketsqzg.tmp

2011-06-14 21:16 . 2011-06-23 00:04 -------- d-----w- c:\windows\system32\NtmsData

2011-06-13 09:51 . 2011-06-13 09:51 167936 ----a-w- c:\windows\system32\ialmrnt532.dll

2011-06-13 09:50 . 2011-06-13 09:50 365056 ----a-w- c:\windows\system32\Audio3D32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-29 16:11 . 2008-08-10 05:10 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-29 16:11 . 2008-08-10 05:10 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-02 15:31 . 2003-03-04 06:57 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-29 16:19 . 2004-04-01 04:49 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-25 16:11 . 2004-01-22 07:16 916480 ----a-w- c:\windows\system32\wininet.dll

2011-04-25 16:11 . 2004-05-20 17:52 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-25 16:11 . 2004-05-20 17:52 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-04-25 12:01 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

2011-04-21 13:37 . 2004-05-20 17:31 105472 ----a-w- c:\windows\system32\drivers\mup.sys

1998-12-09 02:53 . 1998-12-09 02:53 99840 ----a-w- c:\program files\Common Files\IRAABOUT.DLL

1998-12-09 02:53 . 1998-12-09 02:53 70144 ----a-w- c:\program files\Common Files\IRAMDMTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 48640 ----a-w- c:\program files\Common Files\IRALPTTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 31744 ----a-w- c:\program files\Common Files\IRAWEBTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 186368 ----a-w- c:\program files\Common Files\IRAREG.DLL

1998-12-09 02:53 . 1998-12-09 02:53 17920 ----a-w- c:\program files\Common Files\IRASRIAL.DLL

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{014F2DCA-54A8-4544-8766-9C98A03A343f}]

2011-06-13 09:50 365056 ----a-w- c:\windows\system32\Audio3D32.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D4BE1CF-7EA5-A953-5C94-A43862A54CF4}]

2011-06-13 09:51 167936 ----a-w- c:\windows\system32\ialmrnt532.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"YBrowser"="c:\program files\Yahoo!\browser\ybrwicon.exe" [2003-07-11 57344]

"VTTimer"="VTTimer.exe" [2005-03-08 53248]

"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]

"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]

"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-08-21 483328]

"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]

"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]

"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 88209]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2004-11-20 135680]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\ialmrnt532.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]

2004-01-09 09:34 32768 ----a-w- c:\program files\HP\Digital Imaging\bin\BackupNotify.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-13 00:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]

2003-02-12 03:02 61440 ----a-w- c:\hp\KBD\kbd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]

2006-11-20 20:55 380928 ----a-w- c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 19:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wuauserv"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"AntiVirService"=2 (0x2)

"AntiVirSchedulerService"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\ijji\\ENGLISH\\u_gbound.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=

"c:\\Program Files\\Age Of Empires II\\empires2.EXE"=

"c:\\Program Files\\Age Of Empires II\\age2_x1.exe"=

"c:\\Program Files\\Apprentice\\Appr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Infogrames Interactive\\Civilization III\\Conquests\\Civ3Conquests.exe"=

"c:\\Program Files\\Gunbound\\GunboundRV\\Gunbound Revolution\\GunBound.gme"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\LieroX\\LieroX v0.56 Pack 1.8\\LieroX.exe"=

"c:\\Program Files\\Wizet\\MapleStory\\MapleStory.exe"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=

"c:\\WINDOWS\\system32\\dpnsvr.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Wizet\\MapleStory\\Patcher.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Starcraft\\StarCraft.exe"=

"c:\\Dynamix\\Tribes2\\GameData\\Tribes2.exe"=

"c:\\Program Files\\WoS\\Souls.exe"=

"c:\\Program Files\\Xfire\\xfire.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"9420:TCP"= 9420:TCP:*:Disabled:Red Swoosh

"23400:TCP"= 23400:TCP:*:Disabled:LieroX

"23400:UDP"= 23400:UDP:*:Disabled:Liero2

"5000:UDP"= 5000:UDP:*:Disabled:Red Swoosh

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

.

R1 EPPSCSIx;EPPSCSIx;c:\windows\system32\drivers\EPPSCSI.SYS [12/16/2004 1:58 AM 49628]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/17/2011 9:11 PM 136360]

S3 DCamUSBVeo532;Veo Stingray/Connect Web Camera;c:\windows\system32\drivers\ubVeo532.sys [7/1/2002 7:30 PM 95232]

S3 EPUSBSTOR;EPSON USB Storage Driver;c:\windows\system32\drivers\epusbsto.sys [11/20/2004 8:24 PM 17976]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [8/9/2008 10:10 PM 39984]

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-13 07:17]

.

2011-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-13 07:17]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Connection Wizard,ShellNext = hxxp://yahoo.sbc.com/dsl

IE: Add To HP Organize... - c:\progra~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk

Trusted Zone: ameritrade.com

Trusted Zone: tdameritrade.com

TCP: DhcpNameServer = 192.168.1.254

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\

FF - prefs.js: browser.startup.homepage - yahoo.com

FF - Ext: StumbleUpon: {AE93811A-5C9A-4d34-8462-F7B864FC4696} - %profile%\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}

FF - Ext: Adblock: {34274bf4-1d97-a289-e984-17e546307e4f} - %profile%\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: IE Tab: {77b819fa-95ad-4f2c-ac7c-486b356188a9} - %profile%\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} - (no file)

HKLM-Run-PRISMSVR.EXE - c:\windows\system32\PRISMSVR.EXE

HKLM-Run-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe

MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe

AddRemove-36317AE4-57EC-4F3E-B828-009A3DD96BE8 - c:\program files\WildTangent\Apps\GameChannel\Games\36317AE4-57EC-4F3E-B828-009A3DD96BE8\Uninstall.exe

AddRemove-62067F4C-84A9-45B9-8573-B90468B0A3EF - c:\program files\WildTangent\Apps\GameChannel\Games\62067F4C-84A9-45B9-8573-B90468B0A3EF\Uninstall.exe

AddRemove-6723E59E-322A-417A-8E03-27A61E18253C - c:\program files\WildTangent\Apps\GameChannel\Games\6723E59E-322A-417A-8E03-27A61E18253C\Uninstall.exe

AddRemove-8461-7759-5462-8226 - c:\bluimg\azureus\uninstall.exe

AddRemove-8C4E79CC-03E1-43AA-9910-9A5113F24603 - c:\program files\WildTangent\Apps\GameChannel\Games\8C4E79CC-03E1-43AA-9910-9A5113F24603\Uninstall.exe

AddRemove-Ant War - c:\progra~1\ANTWAR~1\UNWISE.EXE

AddRemove-B8610D19-E576-4F91-8A2F-07898D9CA301 - c:\program files\WildTangent\Apps\GameChannel\Games\B8610D19-E576-4F91-8A2F-07898D9CA301\Uninstall.exe

AddRemove-Battle Chess II - Chinese Chess - c:\program files\Interplay Productions\Battle Chess II - Chinese Chess\Uninst.isu

AddRemove-Battle for Wesnoth_is1 - c:\program files\Wesnoth developmental\1-5-0\unins000.exe

AddRemove-BFBCBAE3-8293-4215-9C4F-C2402C118EDB - c:\program files\WildTangent\Apps\GameChannel\Games\BFBCBAE3-8293-4215-9C4F-C2402C118EDB\Uninstall.exe

AddRemove-C2C3C2DB-7D8A-4E20-B527-E3149FAECC3A - c:\program files\WildTangent\Apps\GameChannel\Games\C2C3C2DB-7D8A-4E20-B527-E3149FAECC3A\Uninstall.exe

AddRemove-CampGen_is1 - c:\program files\Wesnoth developmental\CampGen\unins000.exe

AddRemove-D11F7128-8CBD-408B-8BF8-034604DEDD42 - c:\program files\WildTangent\Apps\GameChannel\Games\D11F7128-8CBD-408B-8BF8-034604DEDD42\Uninstall.exe

AddRemove-DA44615A-C243-46A4-8E47-184CFF33CD38 - c:\program files\WildTangent\Apps\GameChannel\Games\DA44615A-C243-46A4-8E47-184CFF33CD38\Uninstall.exe

AddRemove-DAE7A92A-BAC7-42FA-AC62-53DEF1DC4292 - c:\program files\WildTangent\Apps\GameChannel\Games\DAE7A92A-BAC7-42FA-AC62-53DEF1DC4292\Uninstall.exe

AddRemove-E28167F1-3F42-40C7-9119-1D5A97444F10 - c:\program files\WildTangent\Apps\GameChannel\Games\E28167F1-3F42-40C7-9119-1D5A97444F10\Uninstall.exe

AddRemove-F5215F01-DFC0-475D-A910-6F1AF94E807E - c:\program files\WildTangent\Apps\GameChannel\Games\F5215F01-DFC0-475D-A910-6F1AF94E807E\Uninstall.exe

AddRemove-Final Fantasy VII - c:\program files\Square Soft

AddRemove-FlashBoot_is1 - c:\bluimg\FlashBoot\unins000.exe

AddRemove-LSI Soft Modem - c:\windows\agrsmdel

AddRemove-PE Builder_is1 - c:\bluimg\pebuilder3110a\unins000.exe

AddRemove-SBC Self Support Tool - c:\docume~1\Owner\LOCALS~1\Temp\SST\CustomUninstall.exe

AddRemove-Wesnoth_is1 - c:\program files\Wesnoth stable\unins000.exe

AddRemove-WinImage - c:\blusentinal image tools\winimage\winimage.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-22 23:12

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-788326353-1235890415-2902446982-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(540)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\agrsmsvc.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\program files\Common Files\Motive\McciCMService.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\VTTimer.exe

c:\windows\ALCXMNTR.EXE

c:\windows\AGRSMMSG.exe

.

**************************************************************************

.

Completion time: 2011-06-22 23:39:37 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-23 06:39

.

Pre-Run: 42,522,517,504 bytes free

Post-Run: 42,564,423,680 bytes free

.

- - End Of File - - 0A3CFD7AC632D1A968AF945357FA37AE

Elise · June 23, 2011

Hi again,

TWO ANTIVIRUS PROGRAMS

---------------------------------------

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please go to add/remove in the control panel and remove either AVG or Avira.

CF-SCRIPT

-------------

Open notepad and copy/paste the text in the quotebox below into it:

<http://forums.malwarebytes.org/index.php?/topic/87805-google-redirect-and-fsharproj/page__view__findpost__p__444570>

Collect::
c:\windows\system32\ialmrnt532.dll
c:\windows\system32\Audio3D32.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{014F2DCA-54A8-4544-8766-9C98A03A343f}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D4BE1CF-7EA5-A953-5C94-A43862A54CF4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

irritated2011 · June 23, 2011

Elise - I agree - AVG and Avira did not play nicely together. I had hoped to be able to disable AVG's guard function and just use it as another trojan finder - but it (at least the free version) would not allow that. It found two trojans that neither Avira or Malwarebytes found. Combofix refused to run while it was installed so it was actually uninstalled before the first Combofix report. I do have Malware Bytes installed and it plays well with Avira. I won't bother with AVG again.

I ran what you requested and the log is below. Combofix upgraded to a newer version before I ran it.

Thank you for your help - I was very frustrated.

Doug

ComboFix 11-06-23.01 - Owner 06/23/2011 13:09:07.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.211 [GMT -7:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt.lnk

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{92ba9379-b78a-45cb-97ac-05432a5dbbca}

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{92ba9379-b78a-45cb-97ac-05432a5dbbca}\chrome.manifest

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{92ba9379-b78a-45cb-97ac-05432a5dbbca}\chrome\xulcache.jar

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{92ba9379-b78a-45cb-97ac-05432a5dbbca}\defaults\preferences\xulcache.js

c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ntdc9exx.default\extensions\{92ba9379-b78a-45cb-97ac-05432a5dbbca}\install.rdf

.

((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))

.

2011-06-23 02:17 . 2011-06-23 11:24 -------- d-----w- C:\7dea6ba6796f9aaaffcde647872d