Results 1 to 10 of 27

Thread: PC to a crawl, icons disappearing, S & D won't run...

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Angry PC to a crawl, icons disappearing, S & D won't run...

    Hello... my PC appears to have plenty of malware on it. I noticed several pop up ads showing up last week as well as the system slowing to a crawl. I downloaded Spybot S & D and ran it. It found several instances of malware that I thought I had removed successfully. I turned on Tea Timer and immunized and things went well for a couple of days, but now this pc won't do anything. Half of the time I boot up, there are not even any icons showing up. I rebooted until they finally showed so I could get the hijackthis log for some help. I can't even get the internet to come up on that pc anymore and had to transfer the log to this pc to paste it here.

    Any help would be greatly appreciated.

    Here are the logs:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:01:33 AM, on 3/26/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\WINDOWS\system32\sessmgr.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
    O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
    O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
    O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
    O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsour...ad/cscmv5X.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191990441796
    O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
    O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 11916 bytes

  2. #2
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,300

    Default

    Hi,

    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.
    Microsoft Windows Insider MVP 2016-2018
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Thanks Blade81. Here they are.


    DDS (Ver_09-03-16.01) - NTFSx86
    Run by at 22:51:17.20 on Fri 03/27/2009
    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.338 [GMT -5:00]

    AV: AVG 7.5.557 *On-access scanning enabled* (Outdated)
    AV: *On-access scanning disabled* (Outdated)
    FW: *disabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearch Bar =
    uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
    BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
    uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
    uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\688494081.exe
    mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
    mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
    mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
    mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
    mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
    mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
    mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
    mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
    mRun: [Framework Windows] frmwrk32.exe
    dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    uPolicies-explorer: NoFolderOptions = 1 (0x1)
    uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: c:\windows\temp\ntdll64.dll
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
    DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
    LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

    ============= SERVICES / DRIVERS ===============

    R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
    R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
    R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
    R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
    R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
    R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
    S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
    S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
    S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]

    =============== Created Last 30 ================

    2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
    2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
    2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
    2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
    2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
    2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
    2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
    2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
    2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
    2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
    2009-03-25 15:43 32,768 a------- C:\lvsen.exe
    2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
    2009-03-25 15:43 2 a------- C:\-2143619339
    2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
    2009-03-25 15:43 43,008 a------- C:\aywbok.exe
    2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
    2009-03-25 15:43 10,240 a------- C:\stjr.exe
    2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
    2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
    2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
    2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll

    ==================== Find3M ====================

    2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
    2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
    2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
    2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
    2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
    2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
    2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
    2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
    2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
    2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
    2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
    2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
    2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
    2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
    2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
    2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
    2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
    2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
    2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
    2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
    2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
    2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
    2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
    2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
    2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
    2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

    ============= FINISH: 22:58:26.29 ===============

  4. #4
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,300

    Default

    Hi again


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds.txt log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2018
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Hey Blade, it has been a frustrating morning trying to get this for you. First of all, my task manager and registry editor had been disabled by whatever is on my machine. After I googled around and figured out how to fix those, I was finally able to proceed. I went through the steps to disable my AVG and Windows defender... I even turned off my Windows Firewall. When I go and click on the ComboFix.exe icon, nothing happens. However, I can see the process running in task manager. I don't know what else to do at this point. I have rerun a new hijackthis log as well as DDS logs so maybe you can see if I am missing something else. As it stands now... I can't run ComboFix on the infected machine. Here is the Hijack this log and I will attach the DDS logs.


    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Scott & Jenni Kailey at 10:44:01.53 on Sat 03/28/2009
    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.331 [GMT -5:00]

    AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
    AV: *On-access scanning disabled* (Outdated)
    FW: *disabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearch Bar =
    uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
    BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
    uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
    uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\3709125312.exe
    mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
    mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
    mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
    mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
    mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
    mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
    mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
    mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
    mRun: [Framework Windows] frmwrk32.exe
    dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    uPolicies-explorer: NoFolderOptions = 1 (0x1)
    uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: c:\windows\temp\ntdll64.dll
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
    DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
    LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

    ============= SERVICES / DRIVERS ===============

    R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
    R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
    R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
    R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
    R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
    S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
    S2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
    S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
    S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]

    =============== Created Last 30 ================

    2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
    2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
    2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
    2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
    2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
    2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
    2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
    2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
    2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
    2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
    2009-03-25 15:43 32,768 a------- C:\lvsen.exe
    2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
    2009-03-25 15:43 2 a------- C:\-2143619339
    2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
    2009-03-25 15:43 43,008 a------- C:\aywbok.exe
    2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
    2009-03-25 15:43 10,240 a------- C:\stjr.exe
    2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
    2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
    2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
    2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll

    ==================== Find3M ====================

    2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
    2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
    2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
    2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
    2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
    2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
    2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
    2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
    2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
    2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
    2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
    2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
    2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
    2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
    2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
    2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
    2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
    2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
    2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
    2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
    2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
    2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
    2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
    2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
    2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
    2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

    ============= FINISH: 10:50:04.75 ===============

  6. #6
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Sorry, I pasted the DDS file instead of HijackThis. Here is the HijackThis file...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:33:24 AM, on 3/28/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe
    C:\Program Files\Internet Explorer\Iexplore.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
    O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
    O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
    O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
    O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsour...ad/cscmv5X.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191990441796
    O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
    O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 11777 bytes

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •