View Full Version : PC to a crawl, icons disappearing, S & D won't run...
elwayfan446
2009-03-26, 07:15
Hello... my PC appears to have plenty of malware on it. I noticed several pop up ads showing up last week as well as the system slowing to a crawl. I downloaded Spybot S & D and ran it. It found several instances of malware that I thought I had removed successfully. I turned on Tea Timer and immunized and things went well for a couple of days, but now this pc won't do anything. Half of the time I boot up, there are not even any icons showing up. I rebooted until they finally showed so I could get the hijackthis log for some help. I can't even get the internet to come up on that pc anymore and had to transfer the log to this pc to paste it here.
Any help would be greatly appreciated.
Here are the logs:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:33 AM, on 3/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\sessmgr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 11916 bytes
Hi,
Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop. Post them back to your topic.
elwayfan446
2009-03-28, 06:25
Thanks Blade81. Here they are.
DDS (Ver_09-03-16.01) - NTFSx86
Run by at 22:51:17.20 on Fri 03/27/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.338 [GMT -5:00]
AV: AVG 7.5.557 *On-access scanning enabled* (Outdated)
AV: *On-access scanning disabled* (Outdated)
FW: *disabled*
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearch Bar =
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\688494081.exe
mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
mRun: [Framework Windows] frmwrk32.exe
dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\temp\ntdll64.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
============= SERVICES / DRIVERS ===============
R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]
=============== Created Last 30 ================
2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
2009-03-25 15:43 32,768 a------- C:\lvsen.exe
2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
2009-03-25 15:43 2 a------- C:\-2143619339
2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
2009-03-25 15:43 43,008 a------- C:\aywbok.exe
2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
2009-03-25 15:43 10,240 a------- C:\stjr.exe
2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll
==================== Find3M ====================
2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat
============= FINISH: 22:58:26.29 ===============
Hi again :)
Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode
On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds.txt log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
elwayfan446
2009-03-28, 17:59
Hey Blade, it has been a frustrating morning trying to get this for you. First of all, my task manager and registry editor had been disabled by whatever is on my machine. After I googled around and figured out how to fix those, I was finally able to proceed. I went through the steps to disable my AVG and Windows defender... I even turned off my Windows Firewall. When I go and click on the ComboFix.exe icon, nothing happens. However, I can see the process running in task manager. I don't know what else to do at this point. I have rerun a new hijackthis log as well as DDS logs so maybe you can see if I am missing something else. As it stands now... I can't run ComboFix on the infected machine. Here is the Hijack this log and I will attach the DDS logs.
DDS (Ver_09-03-16.01) - NTFSx86
Run by Scott & Jenni Kailey at 10:44:01.53 on Sat 03/28/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.331 [GMT -5:00]
AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
AV: *On-access scanning disabled* (Outdated)
FW: *disabled*
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearch Bar =
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\3709125312.exe
mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
mRun: [Framework Windows] frmwrk32.exe
dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\temp\ntdll64.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
============= SERVICES / DRIVERS ===============
R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
S2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]
=============== Created Last 30 ================
2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
2009-03-25 15:43 32,768 a------- C:\lvsen.exe
2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
2009-03-25 15:43 2 a------- C:\-2143619339
2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
2009-03-25 15:43 43,008 a------- C:\aywbok.exe
2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
2009-03-25 15:43 10,240 a------- C:\stjr.exe
2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll
==================== Find3M ====================
2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat
============= FINISH: 10:50:04.75 ===============
elwayfan446
2009-03-28, 18:02
Sorry, I pasted the DDS file instead of HijackThis. Here is the HijackThis file...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:24 AM, on 3/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\WINDOWS\TEMP\iva39d9.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe
C:\Program Files\Internet Explorer\Iexplore.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 11777 bytes
Hi
Rename ComboFix.exe -> ComFxx.exe and try running it again.
elwayfan446
2009-03-28, 19:04
Thanks Blade. I had to rename it and reboot for it to finally work. I followed the instructions, although there were a couple of steps not mentioned in them. When it first started, it said several instances of something were running in the root and asked me to write down the file names in case we needed them later. I did that so I have them if we need them. It also rebooted my machine after that and another time along the way. Anyway, here is the file.
ComboFix 09-03-27.02 - Owner 2009-03-28 11:47:23.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.579 [GMT -5:00]
Running from: c:\documents and settings\Scott & Jenni Kailey\Desktop\ComFxx.exe
AV: *On-access scanning disabled* (Outdated)
AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
FW: *disabled*
.
Error: Cfolders.dat
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\SCOTT&~1\LOCALS~1\Temp\tmp1.tmp
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\ahtn.htm
c:\windows\system32\ajfutr.dll
c:\windows\system32\bktilu.dll
c:\windows\system32\bozuhanu.dll
c:\windows\system32\bsgwot.dll
c:\windows\system32\dopowihi.dll
c:\windows\system32\drivers\UACtuuvawyl.sys
c:\windows\system32\esgoea.dll
c:\windows\system32\fajohiti.dll
c:\windows\system32\fkqwxi.dll
c:\windows\system32\fonopeja.dll
c:\windows\system32\fuferatu.dll
c:\windows\system32\gaboruwi.dll
c:\windows\system32\ganizoni.dll
c:\windows\system32\gfoszx.dll
c:\windows\system32\gnopoh.dll
c:\windows\system32\hovolile.dll
c:\windows\system32\inbppu.dll
c:\windows\system32\jamuyobo.dll
c:\windows\system32\jipezizo.dll
c:\windows\system32\jttgsx.dll
c:\windows\system32\jukabama.dll
c:\windows\system32\kalojolo.dll
c:\windows\system32\kudavori.dll
c:\windows\system32\kuwakepe.dll
c:\windows\system32\kxyrdh.dll
c:\windows\system32\loditija.dll
c:\windows\system32\mabarili.dll
c:\windows\system32\melamiro.dll
c:\windows\system32\ndhskq.dll
c:\windows\system32\nemudodi.dll
c:\windows\system32\nipimubu.dll
c:\windows\system32\nipujija.dll
c:\windows\system32\nobizoze.dll
c:\windows\system32\ntdll64.exe
c:\windows\system32\nubigojo.dll
c:\windows\system32\padinobo.dll
c:\windows\system32\pezobeto.dll
c:\windows\system32\pkyshn.dll
c:\windows\system32\povelomo.dll
c:\windows\system32\povoyite.dll
c:\windows\system32\puhalima.dll
c:\windows\system32\qxpopb.dll
c:\windows\system32\redivegi.dll
c:\windows\system32\simafubu.dll
c:\windows\system32\subareno.dll
c:\windows\system32\UACdermsqim.log
c:\windows\system32\uacinit.dll
c:\windows\system32\UACktjxvvkb.dll
c:\windows\system32\UACmpxfpjkj.dll
c:\windows\system32\UACmrxpylto.log
c:\windows\system32\UACnpsyeoby.log
c:\windows\system32\UACowtucnpq.dat
c:\windows\system32\UACrjtaxwfh.dll
c:\windows\system32\UACtjujnmka.dll
c:\windows\system32\UACyefrtybo.dll
c:\windows\system32\uniq.tll
c:\windows\system32\vlbsmx.dll
c:\windows\system32\warning.gif
c:\windows\system32\wegenemu.dll
c:\windows\system32\win32hlp.cnf
c:\windows\system32\wofagadu.dll
c:\windows\system32\yoguvesi.dll
c:\windows\system32\yuvetobu.dll
c:\windows\system32\yxfwvu.dll
c:\windows\system32\zasepago.dll
c:\windows\system32\zelaloba.dll
c:\windows\system32\zetajare.dll
c:\windows\Temp\1298325612.exe
c:\windows\Temp\1373013112.exe
c:\windows\Temp\2.exe
D:\Autorun.inf
----- BITS: Possible infected sites -----
hxxp://82.98.235.205
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
-------\Service_PCIDump
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-28 )))))))))))))))))))))))))))))))
.
2009-03-27 17:25 . 2009-03-27 17:25 2,713 ---hs---- c:\windows\system32\wilumoni.exe
2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
2009-03-25 15:57 . 2009-03-25 15:57 136,704 --a------ c:\windows\oqemosar.dll
2009-03-25 15:43 . 2009-03-25 15:43 123,904 --a------ C:\pvnncaoo.exe
2009-03-25 15:43 . 2009-03-28 11:56 109,678 --a------ c:\windows\system32\drivers\c2e18175.sys
2009-03-25 15:43 . 2009-03-25 15:43 43,008 --a------ C:\aywbok.exe
2009-03-25 15:43 . 2009-03-25 15:43 40,448 --a------ c:\windows\Skanagakusadiyu.dll
2009-03-25 15:43 . 2009-03-25 15:43 40,448 --a------ C:\qurdchd.exe
2009-03-25 15:43 . 2009-03-25 15:43 32,768 --a------ C:\lvsen.exe
2009-03-25 15:43 . 2009-03-25 15:43 29,696 --a------ C:\qvmkk.exe
2009-03-25 15:43 . 2009-03-25 15:43 10,240 --a------ C:\stjr.exe
2009-03-25 15:43 . 2009-03-25 15:43 8,704 --a------ C:\gosfrwtt.exe
2009-03-25 15:43 . 2009-03-25 15:43 2 --a------ C:\-2143619339
2009-03-25 15:42 . 2009-03-25 15:42 10,240 --a------ c:\windows\instsp2.exe
2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\romopifo.dll
2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\nekigese.dll
2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\derinade.dll
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-21 08:43 . 2009-03-21 08:43 46,524 --ah----- c:\windows\system32\mlfcache.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 15:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-15 05:43 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
2009-02-15 05:42 --------- d-----w c:\program files\VideoLAN
2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]
"Bxegagecaguhim"="c:\windows\Skanagakusadiyu.dll" [2009-03-25 40448]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
--a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BITS"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcgcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2009-03-25 c:\windows\Tasks\Master Data Backup.job
- c:\windows\system32\ntbackup.exe [2001-08-17 22:36]
2009-03-28 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
- - - - ORPHANS REMOVED - - - -
BHO-{adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
BHO-{dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
HKLM-Run-803af65a - c:\windows\system32\nafugizu.dll
HKLM-Run-CmUsbSound - cmcnfgu.cpl
SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
MSConfigStartUp-CmUsbSound - cmcnfgu.cpl
.
------- Supplementary Scan -------
.
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
LSP: c:\windows\TEMP\ntdll64.dll
DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-28 11:55:36
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
c:\windows\system32\win32hlp.cnf 458 bytes
scan completed successfully
hidden files: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\c2e18175]
"ImagePath"="\SystemRoot\System32\drivers\c2e18175.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\Grisoft\AVGFRE~1\avgamsvr.exe
c:\progra~1\Grisoft\AVGFRE~1\avgupsvc.exe
c:\progra~1\Grisoft\AVGFRE~1\avgemc.exe
c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\sessmgr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\locator.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dlcgcoms.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-03-28 12:00:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-28 17:00:03
Pre-Run: 29,167,935,488 bytes free
Post-Run: 29,372,616,704 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
326 --- E O F --- 2009-03-13 03:02:38
Hi
Please move ComFxx.exe file to root of your c: drive (c:\).
Open notepad and copy/paste the text in the quotebox below into it:
Driver::
nlknhknb
c2e18175
File::
c:\windows\system32\wilumoni.exe
c:\windows\oqemosar.dll
C:\pvnncaoo.exe
c:\windows\system32\drivers\c2e18175.sys
C:\aywbok.exe
c:\windows\Skanagakusadiyu.dll
C:\qurdchd.exe
C:\lvsen.exe
C:\qvmkk.exe
C:\stjr.exe
C:\gosfrwtt.exe
C:\-2143619339
c:\windows\instsp2.exe
c:\windows\system32\romopifo.dll
c:\windows\system32\nekigese.dll
c:\windows\system32\derinade.dll
c:\windows\system32\drivers\nlknhknb.sys
c:\windows\system32\win32hlp.cnf
RegLock::
[HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
Regnull::
[HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bxegagecaguhim"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=-
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComFxx.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Uninstall old Adobe Reader versions and get the latest one here (http://www.filehippo.com/download_adobe_reader/) or get Foxit Reader here (http://www.foxitsoftware.com/pdf/reader_2/down_reader.htm). Make sure you don't install toolbar if choose Foxit Reader!
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6 Update 13 (http://java.sun.com/javase/downloads/index.jsp).
Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version. Uncheck MSN toolbar if it's offered there.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner) as instructed in the screenshot here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif). If you get a message that latest Java must be installed "enable" the Java add-ons in IE7. Do that using "manage add-ons" from the IE7 toolbar.
Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
elwayfan446
2009-03-29, 23:42
Thank you. I have followed the directions in order. Below is the ComboFix log and I have attached the Kaspersky and new DDS logs as well. I also uninstalled my old adobe reader and Java Runtime updates and installed the newest version of each.
ComboFix 09-03-28.06 - 2009-03-29 12:05:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.429 [GMT -5:00]
Running from: C:\ComFxx.exe
Command switches used :: C:\CFScript.txt
AV: *On-access scanning disabled* (Outdated)
AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
FW: *disabled*
* Created a new restore point
FILE ::
C:\-2143619339
C:\aywbok.exe
C:\gosfrwtt.exe
C:\lvsen.exe
C:\pvnncaoo.exe
C:\qurdchd.exe
C:\qvmkk.exe
C:\stjr.exe
c:\windows\instsp2.exe
c:\windows\oqemosar.dll
c:\windows\Skanagakusadiyu.dll
c:\windows\system32\derinade.dll
c:\windows\system32\drivers\c2e18175.sys
c:\windows\system32\drivers\nlknhknb.sys
c:\windows\system32\nekigese.dll
c:\windows\system32\romopifo.dll
c:\windows\system32\wilumoni.exe
c:\windows\system32\win32hlp.cnf
.
Error: Cfolders.dat
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\-2143619339
C:\aywbok.exe
C:\gosfrwtt.exe
C:\lvsen.exe
C:\pvnncaoo.exe
C:\qurdchd.exe
C:\qvmkk.exe
C:\stjr.exe
c:\windows\instsp2.exe
c:\windows\oqemosar.dll
c:\windows\Skanagakusadiyu.dll
c:\windows\system32\derinade.dll
c:\windows\system32\drivers\c2e18175.sys
c:\windows\system32\nekigese.dll
c:\windows\system32\romopifo.dll
c:\windows\system32\veyetidi.dll
c:\windows\system32\wilumoni.exe
c:\windows\system32\win32hlp.cnf
F:\AUTORUN.INF
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_c2e18175
-------\Service_nlknhknb
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
.
2009-03-28 10:20 . 2009-03-29 12:04 2,936,847 -ra------ C:\ComFxx.exe
2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-21 08:43 . 2009-03-21 08:43 46,524 --ah----- c:\windows\system32\mlfcache.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-29 17:11 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-15 05:43 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
2009-02-15 05:42 --------- d-----w c:\program files\VideoLAN
2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
--a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BITS"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcgcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2009-03-25 c:\windows\Tasks\Master Data Backup.job
- c:\windows\system32\ntbackup.exe [2001-08-17 22:36]
2009-03-29 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Supplementary Scan -------
.
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
LSP: c:\windows\TEMP\ntdll64.dll
FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-29 12:12:03
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\Grisoft\AVGFRE~1\avgamsvr.exe
c:\progra~1\Grisoft\AVGFRE~1\avgupsvc.exe
c:\progra~1\Grisoft\AVGFRE~1\avgemc.exe
c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\sessmgr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\locator.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dlcgcoms.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-03-29 12:19:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-29 17:19:18
ComboFix2.txt 2009-03-28 17:00:07
Pre-Run: 29,459,685,376 bytes free
Post-Run: 29,442,879,488 bytes free
238 --- E O F --- 2009-03-13 03:02:38
Ok. Let's continue :)
Open notepad and copy/paste the text in the quotebox below into it:
File::
c:\windows\system32\mlfcache.dat
C:\Documents and Settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\37\63380ea5-67161fdb
C:\Documents and Settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\54\6e4d3ab6-4f4a55e5
c:\windows\system32\win32hlp.cnf
c:\windows\temp\ntdll64.dll
DDS::
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows (including this one!) Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Please post contents of that file, above mentioned ComboFix log & a fresh dds log in your next reply.
elwayfan446
2009-03-31, 04:51
Thanks Blade...
I have pasted the ComboFix log and attached the rest. Just so you know... while I was running the Malwarebytes' Anti-Malware, my AVG popped up after about an hour. It apparently had been scanning as well, even though I disabled it as instructed in previous posts. When my PC rebooted from ComboFix, it was in the system tray, but everything was disabled as it should have been. I just canceled it when I saw it. Also, Malwarebytes' Anti-Malware prompted me for a reboot after it was finished removing everything so I did. It was not in your instructions so I wanted to let you know it happened. The DDS logs are from after that reboot.
Thanks again... I hope we are getting closer. However... as we speak I see windows popping open and immediately closing on the infected PC so I am concerned it is not clean. I have disconnected it from the internet until I hear back. :sad:
ComboFix 09-03-29.04 - owner 2009-03-30 18:36:57.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.595 [GMT -5:00]
Running from: C:\ComFxx.exe
Command switches used :: C:\CFScript.txt
AV: *On-access scanning disabled* (Outdated)
AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
FW: *disabled*
* Created a new restore point
FILE ::
c:\documents and settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\37\63380ea5-67161fdb
c:\documents and settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\54\6e4d3ab6-4f4a55e5
c:\windows\system32\mlfcache.dat
c:\windows\system32\win32hlp.cnf
c:\windows\temp\ntdll64.dll
.
Error: Cfolders.dat
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\37\63380ea5-67161fdb
c:\documents and settings\Scott & Jenni Kailey\Application Data\Sun\Java\Deployment\cache\6.0\54\6e4d3ab6-4f4a55e5
c:\windows\system32\mlfcache.dat
c:\windows\system32\win32hlp.cnf
c:\windows\temp\ntdll64.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))
.
2009-03-29 12:55 . 2009-03-29 12:55 410,984 --a------ c:\windows\system32\deploytk.dll
2009-03-29 12:55 . 2009-03-29 12:55 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-28 10:20 . 2009-03-30 18:35 2,937,685 -ra------ C:\ComFxx.exe
2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-15 00:43 . 2009-02-15 00:43 <DIR> d-------- c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
2009-02-15 00:42 . 2009-02-15 00:42 <DIR> d-------- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-30 23:43 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-03-29 17:54 --------- d-----w c:\program files\Java
2009-03-29 17:52 --------- d-----w c:\program files\Common Files\Adobe
2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-28_11.59.02.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-07-12 06:22:00 135,168 ----a-w c:\windows\system32\java.exe
+ 2009-03-29 17:55:00 144,792 ----a-w c:\windows\system32\java.exe
- 2007-07-12 06:22:04 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2009-03-29 17:55:00 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-07-12 07:22:38 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2009-03-29 17:55:00 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2009-03-30 23:42:34 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_2c4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
--a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BITS"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcgcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2009-03-25 c:\windows\Tasks\Master Data Backup.job
- c:\windows\system32\ntbackup.exe [2001-08-17 22:36]
2009-03-30 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
.
------- Supplementary Scan -------
.
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071102000004.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-30 18:43:51
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\progra~1\Grisoft\AVGFRE~1\avgamsvr.exe
c:\progra~1\Grisoft\AVGFRE~1\avgupsvc.exe
c:\progra~1\Grisoft\AVGFRE~1\avgemc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\sessmgr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\locator.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dlcgcoms.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-03-30 18:52:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-30 23:51:40
ComboFix2.txt 2009-03-29 17:19:29
ComboFix3.txt 2009-03-28 17:00:07
Pre-Run: 29,683,679,232 bytes free
Post-Run: 29,728,296,960 bytes free
226 --- E O F --- 2009-03-13 03:02:38
Hi
What kind of popups are remaining there?
Open notepad and copy/paste the text in the quotebox below into it:
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"=-
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
BTW, your AVG seems to be outdated. Have you checked is it able to update itself?
elwayfan446
2009-04-01, 03:05
Well, that is why I am worried. They pop open and closed so fast, I can't tell. It is obvious it is something being run in the background. As far as AVG is concerned, it has not updated successfully in some time. It kept telling me it needed to reboot for it to finish, When I would reboot... nothing changed. When I would click on the red update manager, it kept telling me that it needed to be rebooted. I figured once I got all of this cleaned up, I would be able to install the latest version.
Here is the log.
ComboFix 09-03-29.04 - 2009-03-31 18:53:49.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.430 [GMT -5:00]
Running from: C:\ComFxx.exe
Command switches used :: F:\CFScript.txt
AV: *On-access scanning disabled* (Outdated)
AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
FW: *disabled*
* Created a new restore point
.
Error: Cfolders.dat
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))
.
2009-03-30 19:09 . 2009-03-30 19:09 <DIR> d-------- c:\documents and settings\Scott & Jenni Kailey\Application Data\Malwarebytes
2009-03-30 19:08 . 2009-03-30 19:09 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-30 19:08 . 2009-03-30 19:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-30 19:08 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-30 19:08 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-29 12:55 . 2009-03-29 12:55 410,984 --a------ c:\windows\system32\deploytk.dll
2009-03-29 12:55 . 2009-03-29 12:55 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-28 10:20 . 2009-03-30 18:35 2,937,685 -ra------ C:\ComFxx.exe
2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-15 00:43 . 2009-02-15 00:43 <DIR> d-------- c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
2009-02-15 00:42 . 2009-02-15 00:42 <DIR> d-------- c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-30 23:43 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-03-29 17:54 --------- d-----w c:\program files\Java
2009-03-29 17:52 --------- d-----w c:\program files\Common Files\Adobe
2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:13 1,846,784 ------w c:\windows\system32\dllcache\win32k.sys
2009-01-27 06:55 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-01-17 03:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr
2008-12-19 09:10 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-05 06:54 144,896 ----a-w c:\windows\system32\schannel.dll
2008-12-05 06:54 144,896 ------w c:\windows\system32\dllcache\schannel.dll
2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-03-28_11.59.02.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-07-12 06:22:00 135,168 ----a-w c:\windows\system32\java.exe
+ 2009-03-29 17:55:00 144,792 ----a-w c:\windows\system32\java.exe
- 2007-07-12 06:22:04 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2009-03-29 17:55:00 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-07-12 07:22:38 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2009-03-29 17:55:00 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2009-03-31 01:34:27 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_e4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
--a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BITS"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dlcgcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
"c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
2009-03-31 c:\windows\Tasks\Master Data Backup.job
- c:\windows\system32\ntbackup.exe [2001-08-17 22:36]
2009-03-31 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
.
.
------- Supplementary Scan -------
.
uStart Page = https://fp.bankshare.info/my.logon.php3
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 128.238.88.64:3128
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-31 18:57:12
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-03-31 18:59:28
ComboFix-quarantined-files.txt 2009-03-31 23:59:25
ComboFix2.txt 2009-03-30 23:52:05
ComboFix3.txt 2009-03-29 17:19:29
ComboFix4.txt 2009-03-28 17:00:07
Pre-Run: 29,702,090,752 bytes free
Post-Run: 29,683,744,768 bytes free
199 --- E O F --- 2009-03-13 03:02:38
Hi
Download GMER (http://www.gmer.net/gmer.zip) and save it your desktop:
Extract it to your desktop and double-click GMER.exe
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.
elwayfan446
2009-04-01, 21:23
Blade, I kicked this off right before I left this morning. I don't have access to the PC right now, but my wife called me and told me that in the middle of the scan it gave her a blue screen that told her something to the effect of having a critical error and having to shut down. I had her shut it down and fire it back up and she saw an error box that said the system was recovering from an error and "Please don't tell Microsoft". There was a way to view the files that were involved, but not easily print a log. (It was to hard to explain to her how to send me a screen shot). I had her try to run GMER again and after about 5 minutes she got another error that said something to the effect that "GMER encountered an error and must shut down". I just told her to shut it down and I would try again later.
In the meantime I wanted to post that info here before it got too late and you were no longer online. Do you have anything else you want me to try when I get home this evening?
elwayfan446
2009-04-02, 07:25
Hi Blade...
Ok, so I got home and I ran it again myself. After about 1 1/2 hours... I get a blue screen that says the following:
A problem has been detected and windows has been shut down to prevent damage to your computer.
The problem seems to be caused by the following file: aujasnkj.sys
PAGE_FAULT_IN_NONPAGED_AREA
If this is the first time you have seen this stop error screen, restart your compurter. If this screen appears again, follow these steps:
Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Technical Information:
*** STOP: 0x00000050 (0xFDAD9000,0x00000000,0xEF17F5B6,0x00000000)
*** aujasnkj.sys - Address EF17F5B6 base at EF174000, DateStamp 49b65e3c
Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further assistance
I have restarted the computer and this is where I stand...
Hi
Do those bluescreens still occur (if you don't run GMER)? Please see if you can update AVG at this point. If update doesn't work, please reinstall AVG. Let me know how it goes.
About those popups.. Were those website ones or some command boxes (black background with white text)?
elwayfan446
2009-04-02, 14:33
Hey Blade,
No the blue screens have only occurred when I run GMER. So far, no other time. When I tried to update AVG, it would not update, so I have uninstalled it and reinstalled AVG 8.5 Free Edition. After installation I was able to download updates.
** Side note, I am not able to see any images when using IE7, only in Firefox. Not sure if it is something I have disabled along the way to run these scans or if there is an issue.
I have not seen the box run since the first time I reported it to you, but it seemed like a web box, not a command prompt.
I will await word from you before I do anything else.
Thanks again for your continued help.
Hi
Please see instructions for picture displaying issue here (http://support.microsoft.com/kb/283807).
I think it's best if we'll uninstall ComboFix now and see how the system behaves during next few days.
Click START then RUN
Now type "C:\ComFxx.exe" /u in the runbox and click OK
elwayfan446
2009-04-02, 20:30
Ok, I will do this tonight, should I enable AVG, Spybot, Defender... etc. again?
Yes, you may re-enable those after ComboFix is uninstalled :)
elwayfan446
2009-04-04, 06:03
Hi Blade,
ne
Things just don't seem back to normal yet. When trying to get all of my security back in place, I noticed I was not able to reactivate Windows Defender. I just kept getting a message that said I would have to do it from control panel. When I would try to do it from there, nothing happened. After researching it, I found out that the automatic updates had been disabled. When I try to enable it, I get an error that says "access denied". After researching that, I couldn't find a method that seemed real easy... so I thought I would run it by you and see what I need to do.
All this and it still seems my browers are sluggish... and so is the startup of my computer. I ran AVG and Spybot last night and they don't appear to have found anything.
What do you recommend next?
Hi
When have the hard drive partitions been defragged previously?
Backup Your Registry with ERUNT:
Download erunt.zip to your Desktop from here:
http://aumha.org/downloads/erunt.zip
Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to a new folder on your Desktop
Inside the new folder, double-click ERUNT.exe to start the program
OK all the prompts to back up your registry to the default location.Note: to restore your registry, go to the backup folder and start ERDNT.exe
Click Start then Run
Type in regedit
Click Ok.
In left pane of registry editor, Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
Right click the key then choose permissions> advanced> check "inherit from the parent........> apply> ok.
See if you can change automatic updates service from services.msc now.
elwayfan446
2009-04-06, 02:05
Ok, I was able to get automatic updates working again. I have downloaded all of the latest updates and defragged the computer. I also used Spybot to turn off the processes that run during startup. My startup still seems slow and so does the time it takes my browser to open when I open the internet. Any more suggestions?
Hi
You may see here (http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html) if any of those hints helps.
Due to inactivity, this thread will now be closed.
Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.
If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.