Page 1 of 3 123 LastLast
Results 1 to 10 of 27

Thread: PC to a crawl, icons disappearing, S & D won't run...

  1. #1
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Angry PC to a crawl, icons disappearing, S & D won't run...

    Hello... my PC appears to have plenty of malware on it. I noticed several pop up ads showing up last week as well as the system slowing to a crawl. I downloaded Spybot S & D and ran it. It found several instances of malware that I thought I had removed successfully. I turned on Tea Timer and immunized and things went well for a couple of days, but now this pc won't do anything. Half of the time I boot up, there are not even any icons showing up. I rebooted until they finally showed so I could get the hijackthis log for some help. I can't even get the internet to come up on that pc anymore and had to transfer the log to this pc to paste it here.

    Any help would be greatly appreciated.

    Here are the logs:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:01:33 AM, on 3/26/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\WINDOWS\system32\sessmgr.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
    O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
    O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
    O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
    O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsour...ad/cscmv5X.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191990441796
    O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
    O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 11916 bytes

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Thanks Blade81. Here they are.


    DDS (Ver_09-03-16.01) - NTFSx86
    Run by at 22:51:17.20 on Fri 03/27/2009
    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.338 [GMT -5:00]

    AV: AVG 7.5.557 *On-access scanning enabled* (Outdated)
    AV: *On-access scanning disabled* (Outdated)
    FW: *disabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\688494081.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearch Bar =
    uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
    BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
    uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
    uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\688494081.exe
    mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
    mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
    mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
    mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
    mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
    mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
    mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
    mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
    mRun: [Framework Windows] frmwrk32.exe
    dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    uPolicies-explorer: NoFolderOptions = 1 (0x1)
    uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: c:\windows\temp\ntdll64.dll
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
    DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
    LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

    ============= SERVICES / DRIVERS ===============

    R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
    R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
    R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
    R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
    R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
    R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
    S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
    S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
    S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]

    =============== Created Last 30 ================

    2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
    2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
    2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
    2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
    2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
    2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
    2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
    2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
    2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
    2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
    2009-03-25 15:43 32,768 a------- C:\lvsen.exe
    2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
    2009-03-25 15:43 2 a------- C:\-2143619339
    2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
    2009-03-25 15:43 43,008 a------- C:\aywbok.exe
    2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
    2009-03-25 15:43 10,240 a------- C:\stjr.exe
    2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
    2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
    2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
    2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll

    ==================== Find3M ====================

    2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
    2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
    2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
    2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
    2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
    2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
    2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
    2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
    2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
    2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
    2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
    2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
    2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
    2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
    2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
    2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
    2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
    2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
    2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
    2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
    2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
    2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
    2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
    2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
    2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
    2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

    ============= FINISH: 22:58:26.29 ===============

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds.txt log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Hey Blade, it has been a frustrating morning trying to get this for you. First of all, my task manager and registry editor had been disabled by whatever is on my machine. After I googled around and figured out how to fix those, I was finally able to proceed. I went through the steps to disable my AVG and Windows defender... I even turned off my Windows Firewall. When I go and click on the ComboFix.exe icon, nothing happens. However, I can see the process running in task manager. I don't know what else to do at this point. I have rerun a new hijackthis log as well as DDS logs so maybe you can see if I am missing something else. As it stands now... I can't run ComboFix on the infected machine. Here is the Hijack this log and I will attach the DDS logs.


    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Scott & Jenni Kailey at 10:44:01.53 on Sat 03/28/2009
    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_02
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.331 [GMT -5:00]

    AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
    AV: *On-access scanning disabled* (Outdated)
    FW: *disabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearch Bar =
    uDefault_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda}: {adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
    BHO: {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
    TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {4E7BD74F-2B8D-469E-85AA-FD60BB9AAE22} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    uRun: [<NO NAME>] c:\windows\temp\iva39d9.exe
    uRun: [Windows Resurections] c:\windows\temp\iva39d9.exe
    uRun: [Diagnostic Manager] c:\docume~1\scott&~1\locals~1\temp\3709125312.exe
    mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe"
    mRun: [dlcgmon.exe] "c:\program files\dell aio 810\dlcgmon.exe"
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
    mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
    mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
    mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe c:\documents and settings\scott & jenni kailey\desktop\Vanderkolk.pdf
    mRun: [DLCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCGtime.dll,RunDLLEntry
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [wadafunati] Rundll32.exe "c:\windows\system32\subareno.dll",s
    mRun: [803af65a] rundll32.exe "c:\windows\system32\nafugizu.dll",b
    mRun: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    mRun: [Bxegagecaguhim] rundll32.exe "c:\windows\Skanagakusadiyu.dll",e
    mRun: [Framework Windows] frmwrk32.exe
    dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    uPolicies-explorer: NoFolderOptions = 1 (0x1)
    uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    uPolicies-system: DisableRegistryTools = 1 (0x1)
    mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: c:\windows\temp\ntdll64.dll
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/0/5/7/05796dde-b2ba-4eef-8da4-f99c7e0c9b92/LegitCheckControl.cab
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
    DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
    DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1191990441796
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    AppInit_DLLs: c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\nobizoze.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
    LSA: Notification Packages = scecli c:\windows\system32\popifimi.dll c:\windows\system32\yoguvesi.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\scott&~1\applic~1\mozilla\firefox\profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\{0c7e3f01-99e9-4095-9bdc-f84724960b57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\scott & jenni kailey\application data\mozilla\firefox\profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

    ============= SERVICES / DRIVERS ===============

    R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2006-7-19 821856]
    R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2006-7-19 4224]
    R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2006-7-19 27776]
    R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-1-16 10760]
    R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2006-7-19 4960]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-1-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-1-26 252160]
    S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
    S2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avgfre~1\avgamsvr.exe [2006-7-19 418816]
    S2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avgfre~1\avgupsvc.exe [2006-7-19 49664]
    S2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avgfre~1\avgemc.exe [2006-7-19 406528]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-1-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-1-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\drivers\urvpndrv.sys --> c:\windows\system32\drivers\urvpndrv.sys [?]

    =============== Created Last 30 ================

    2009-03-27 17:25 2,713 ---sh--- c:\windows\system32\wilumoni.exe
    2009-03-25 15:57 136,704 a------- c:\windows\oqemosar.dll
    2009-03-25 15:49 488 a------- c:\windows\system32\win32hlp.cnf
    2009-03-25 15:45 1,394 a------- c:\windows\system32\ahtn.htm
    2009-03-25 15:45 4,785 a------- c:\windows\system32\warning.gif
    2009-03-25 15:44 104,960 a------- c:\windows\system32\dllcache\userinit.exe
    2009-03-25 15:44 104,960 a------- c:\windows\system32\ntdll64.exe
    2009-03-25 15:44 1 a------- c:\windows\system32\uniq.tll
    2009-03-25 15:43 109,678 a------- c:\windows\system32\drivers\c2e18175.sys
    2009-03-25 15:43 123,904 a------- C:\pvnncaoo.exe
    2009-03-25 15:43 32,768 a------- C:\lvsen.exe
    2009-03-25 15:43 29,696 a------- C:\qvmkk.exe
    2009-03-25 15:43 2 a------- C:\-2143619339
    2009-03-25 15:43 8,704 a------- C:\gosfrwtt.exe
    2009-03-25 15:43 43,008 a------- C:\aywbok.exe
    2009-03-25 15:43 40,448 a------- c:\windows\Skanagakusadiyu.dll
    2009-03-25 15:43 10,240 a------- C:\stjr.exe
    2009-03-25 15:43 40,448 a------- C:\qurdchd.exe
    2009-03-25 15:42 10,240 a------- c:\windows\instsp2.exe
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\gnopoh.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\qxpopb.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\nekigese.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\derinade.dll
    2009-03-24 14:38 2,713 ---sh--- c:\windows\system32\romopifo.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\fkqwxi.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\kxyrdh.dll
    2009-03-21 09:49 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\yxfwvu.dll
    2009-03-21 08:43 46,524 a---h--- c:\windows\system32\mlfcache.dat
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\inbppu.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\esgoea.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\bktilu.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pkyshn.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\bsgwot.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\ajfutr.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\gfoszx.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\jttgsx.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\ndhskq.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\vlbsmx.dll

    ==================== Find3M ====================

    2009-03-25 15:44 104,960 a------- c:\windows\system32\userinit.exe
    2009-03-25 15:42 99,840 a--sh--- c:\windows\system32\veyetidi.dll
    2009-03-25 15:42 139,264 a--sh--- c:\windows\system32\povelomo.dll
    2009-03-25 15:42 105,472 a--sh--- c:\windows\system32\nobizoze.dll
    2009-03-25 03:43 140,800 a--sh--- c:\windows\system32\fonopeja.dll
    2009-03-23 08:23 140,800 a--sh--- c:\windows\system32\padinobo.dll
    2009-03-21 21:35 141,824 a--sh--- c:\windows\system32\mabarili.dll
    2009-03-21 09:34 142,848 a--sh--- c:\windows\system32\redivegi.dll
    2009-03-20 21:34 107,008 a--sh--- c:\windows\system32\melamiro.dll
    2009-03-20 21:34 142,848 a--sh--- c:\windows\system32\nubigojo.dll
    2009-03-20 21:34 101,888 -------- c:\windows\system32\wegenemu.dll
    2009-03-20 09:34 107,520 a--sh--- c:\windows\system32\jamuyobo.dll
    2009-03-20 09:34 141,824 a--sh--- c:\windows\system32\povoyite.dll
    2009-03-19 21:33 108,544 a--sh--- c:\windows\system32\nemudodi.dll
    2009-03-19 21:33 141,312 a--sh--- c:\windows\system32\nipujija.dll
    2009-03-19 21:33 102,400 -------- c:\windows\system32\gaboruwi.dll
    2009-03-19 09:36 141,824 a--sh--- c:\windows\system32\pezobeto.dll
    2009-03-19 09:36 106,496 a--sh--- c:\windows\system32\nipimubu.dll
    2009-03-19 09:36 101,376 -------- c:\windows\system32\yuvetobu.dll
    2009-03-17 21:22 103,424 -------- c:\windows\system32\simafubu.dll
    2009-03-17 21:22 142,336 a--sh--- c:\windows\system32\zelaloba.dll
    2009-03-17 21:22 106,496 a--sh--- c:\windows\system32\jipezizo.dll
    2009-03-17 09:22 142,848 a--sh--- c:\windows\system32\puhalima.dll
    2009-03-17 09:22 101,376 -------- c:\windows\system32\fuferatu.dll
    2009-03-17 09:22 108,032 a--sh--- c:\windows\system32\kalojolo.dll
    2009-03-16 21:22 101,376 -------- c:\windows\system32\kudavori.dll
    2009-03-16 21:22 107,008 a--sh--- c:\windows\system32\hovolile.dll
    2009-03-16 21:22 141,312 a--sh--- c:\windows\system32\zetajare.dll
    2009-03-16 07:09 102,400 -------- c:\windows\system32\zasepago.dll
    2009-03-16 07:09 142,848 a--sh--- c:\windows\system32\fajohiti.dll
    2009-03-16 07:09 106,496 a--sh--- c:\windows\system32\ganizoni.dll
    2009-03-15 13:03 141,824 a--sh--- c:\windows\system32\bozuhanu.dll
    2009-03-15 13:03 107,520 a--sh--- c:\windows\system32\wofagadu.dll
    2009-03-14 22:40 123,392 a--sh--- c:\windows\system32\kuwakepe.dll
    2009-03-14 22:40 80,896 -------- c:\windows\system32\jukabama.dll
    2009-03-14 22:40 86,016 a--sh--- c:\windows\system32\dopowihi.dll
    2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys
    2009-01-27 01:55 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-01-05 17:33 3,751,995 a------- c:\windows\system32\GPhotos.scr
    2007-04-18 20:08 44,408 -------- c:\docume~1\scott&~1\applic~1\GDIPFONTCACHEV1.DAT
    2006-09-17 20:33 563,712 -------- c:\documents and settings\scott & jenni kailey\gotomypc_370.exe
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\loditija.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\subareno.dll
    0000-00-00 00:00 69,632 a--sh--- c:\windows\system32\yoguvesi.dll
    2008-09-05 06:04 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

    ============= FINISH: 10:50:04.75 ===============

  6. #6
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Sorry, I pasted the DDS file instead of HijackThis. Here is the HijackThis file...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:33:24 AM, on 3/28/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Dell AIO 810\dlcgmon.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
    C:\WINDOWS\system32\dlcgcoms.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\WINDOWS\TEMP\iva39d9.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\ComboFix.exe
    C:\Documents and Settings\Scott & Jenni Kailey\Desktop\HiJackThis.exe
    C:\Program Files\Internet Explorer\Iexplore.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fp.bankshare.info/my.logon.php3
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.238.88.64:3128
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: {3e58402e-bf09-4778-e694-47dfb2ca3fda} - {adf3ac2b-fd74-496e-8774-90fbe20485e3} - C:\WINDOWS\system32\gnopoh.dll
    O2 - BHO: (no name) - {dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - C:\WINDOWS\system32\loditija.dll
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe C:\Documents and Settings\Scott & Jenni Kailey\Desktop\Vanderkolk.pdf
    O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [wadafunati] Rundll32.exe "C:\WINDOWS\system32\subareno.dll",s
    O4 - HKLM\..\Run: [803af65a] rundll32.exe "C:\WINDOWS\system32\nafugizu.dll",b
    O4 - HKLM\..\Run: [CPM8309c5c6] Rundll32.exe "c:\windows\system32\nobizoze.dll",a
    O4 - HKLM\..\Run: [Bxegagecaguhim] rundll32.exe "C:\WINDOWS\Skanagakusadiyu.dll",e
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\iva39d9.exe
    O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\SCOTT&~1\LOCALS~1\Temp\3709125312.exe
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O10 - Unknown file in Winsock LSP: c:\windows\temp\ntdll64.dll
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://coolsavings.coupons.smartsour...ad/cscmv5X.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191990441796
    O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\popifimi.dll C:\WINDOWS\system32\yoguvesi.dll c:\windows\system32\gujayiwo.dll c:\windows\system32\weluyotu.dll c:\windows\system32\kewupupe.dll gnopoh.dll c:\windows\system32\nobizoze.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
    O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 11777 bytes

  7. #7
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Rename ComboFix.exe -> ComFxx.exe and try running it again.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  8. #8
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Thanks Blade. I had to rename it and reboot for it to finally work. I followed the instructions, although there were a couple of steps not mentioned in them. When it first started, it said several instances of something were running in the root and asked me to write down the file names in case we needed them later. I did that so I have them if we need them. It also rebooted my machine after that and another time along the way. Anyway, here is the file.

    ComboFix 09-03-27.02 - Owner 2009-03-28 11:47:23.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.579 [GMT -5:00]
    Running from: c:\documents and settings\Scott & Jenni Kailey\Desktop\ComFxx.exe
    AV: *On-access scanning disabled* (Outdated)
    AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
    FW: *disabled*
    .
    Error: Cfolders.dat

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\SCOTT&~1\LOCALS~1\Temp\tmp1.tmp
    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    c:\windows\system32\ahtn.htm
    c:\windows\system32\ajfutr.dll
    c:\windows\system32\bktilu.dll
    c:\windows\system32\bozuhanu.dll
    c:\windows\system32\bsgwot.dll
    c:\windows\system32\dopowihi.dll
    c:\windows\system32\drivers\UACtuuvawyl.sys
    c:\windows\system32\esgoea.dll
    c:\windows\system32\fajohiti.dll
    c:\windows\system32\fkqwxi.dll
    c:\windows\system32\fonopeja.dll
    c:\windows\system32\fuferatu.dll
    c:\windows\system32\gaboruwi.dll
    c:\windows\system32\ganizoni.dll
    c:\windows\system32\gfoszx.dll
    c:\windows\system32\gnopoh.dll
    c:\windows\system32\hovolile.dll
    c:\windows\system32\inbppu.dll
    c:\windows\system32\jamuyobo.dll
    c:\windows\system32\jipezizo.dll
    c:\windows\system32\jttgsx.dll
    c:\windows\system32\jukabama.dll
    c:\windows\system32\kalojolo.dll
    c:\windows\system32\kudavori.dll
    c:\windows\system32\kuwakepe.dll
    c:\windows\system32\kxyrdh.dll
    c:\windows\system32\loditija.dll
    c:\windows\system32\mabarili.dll
    c:\windows\system32\melamiro.dll
    c:\windows\system32\ndhskq.dll
    c:\windows\system32\nemudodi.dll
    c:\windows\system32\nipimubu.dll
    c:\windows\system32\nipujija.dll
    c:\windows\system32\nobizoze.dll
    c:\windows\system32\ntdll64.exe
    c:\windows\system32\nubigojo.dll
    c:\windows\system32\padinobo.dll
    c:\windows\system32\pezobeto.dll
    c:\windows\system32\pkyshn.dll
    c:\windows\system32\povelomo.dll
    c:\windows\system32\povoyite.dll
    c:\windows\system32\puhalima.dll
    c:\windows\system32\qxpopb.dll
    c:\windows\system32\redivegi.dll
    c:\windows\system32\simafubu.dll
    c:\windows\system32\subareno.dll
    c:\windows\system32\UACdermsqim.log
    c:\windows\system32\uacinit.dll
    c:\windows\system32\UACktjxvvkb.dll
    c:\windows\system32\UACmpxfpjkj.dll
    c:\windows\system32\UACmrxpylto.log
    c:\windows\system32\UACnpsyeoby.log
    c:\windows\system32\UACowtucnpq.dat
    c:\windows\system32\UACrjtaxwfh.dll
    c:\windows\system32\UACtjujnmka.dll
    c:\windows\system32\UACyefrtybo.dll
    c:\windows\system32\uniq.tll
    c:\windows\system32\vlbsmx.dll
    c:\windows\system32\warning.gif
    c:\windows\system32\wegenemu.dll
    c:\windows\system32\win32hlp.cnf
    c:\windows\system32\wofagadu.dll
    c:\windows\system32\yoguvesi.dll
    c:\windows\system32\yuvetobu.dll
    c:\windows\system32\yxfwvu.dll
    c:\windows\system32\zasepago.dll
    c:\windows\system32\zelaloba.dll
    c:\windows\system32\zetajare.dll
    c:\windows\Temp\1298325612.exe
    c:\windows\Temp\1373013112.exe
    c:\windows\Temp\2.exe
    D:\Autorun.inf

    ----- BITS: Possible infected sites -----

    hxxp://82.98.235.205
    Infected copy of c:\windows\system32\userinit.exe was found and disinfected
    Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe


    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_UACd.sys
    -------\Service_PCIDump


    ((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-28 )))))))))))))))))))))))))))))))
    .

    2009-03-27 17:25 . 2009-03-27 17:25 2,713 ---hs---- c:\windows\system32\wilumoni.exe
    2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
    2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
    2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
    2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
    2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
    2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
    2009-03-25 15:57 . 2009-03-25 15:57 136,704 --a------ c:\windows\oqemosar.dll
    2009-03-25 15:43 . 2009-03-25 15:43 123,904 --a------ C:\pvnncaoo.exe
    2009-03-25 15:43 . 2009-03-28 11:56 109,678 --a------ c:\windows\system32\drivers\c2e18175.sys
    2009-03-25 15:43 . 2009-03-25 15:43 43,008 --a------ C:\aywbok.exe
    2009-03-25 15:43 . 2009-03-25 15:43 40,448 --a------ c:\windows\Skanagakusadiyu.dll
    2009-03-25 15:43 . 2009-03-25 15:43 40,448 --a------ C:\qurdchd.exe
    2009-03-25 15:43 . 2009-03-25 15:43 32,768 --a------ C:\lvsen.exe
    2009-03-25 15:43 . 2009-03-25 15:43 29,696 --a------ C:\qvmkk.exe
    2009-03-25 15:43 . 2009-03-25 15:43 10,240 --a------ C:\stjr.exe
    2009-03-25 15:43 . 2009-03-25 15:43 8,704 --a------ C:\gosfrwtt.exe
    2009-03-25 15:43 . 2009-03-25 15:43 2 --a------ C:\-2143619339
    2009-03-25 15:42 . 2009-03-25 15:42 10,240 --a------ c:\windows\instsp2.exe
    2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\romopifo.dll
    2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\nekigese.dll
    2009-03-24 14:38 . 2009-03-24 14:38 2,713 ---hs---- c:\windows\system32\derinade.dll
    2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-03-21 08:43 . 2009-03-21 08:43 46,524 --ah----- c:\windows\system32\mlfcache.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-28 15:04 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
    2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
    2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
    2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
    2009-02-15 05:43 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
    2009-02-15 05:42 --------- d-----w c:\program files\VideoLAN
    2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
    2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
    2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
    2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
    "dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
    "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
    "DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]
    "Bxegagecaguhim"="c:\windows\Skanagakusadiyu.dll" [2009-03-25 40448]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
    --a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "BITS"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
    "c:\\WINDOWS\\system32\\dlcgcoms.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\ftp.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
    "c:\\Program Files\\SopCast\\SopCast.exe"=
    "c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\Digital Line Detect\\DLG.exe"=
    "c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
    "c:\\Program Files\\Windows Defender\\MsMpEng.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "135:TCP"= 135:TCP:TCP Port 135
    "5000:TCP"= 5000:TCP:TCP Port 5000
    "5001:TCP"= 5001:TCP:TCP Port 5001
    "5002:TCP"= 5002:TCP:TCP Port 5002
    "5003:TCP"= 5003:TCP:TCP Port 5003
    "5004:TCP"= 5004:TCP:TCP Port 5004
    "5005:TCP"= 5005:TCP:TCP Port 5005
    "5006:TCP"= 5006:TCP:TCP Port 5006
    "5007:TCP"= 5007:TCP:TCP Port 5007
    "5008:TCP"= 5008:TCP:TCP Port 5008
    "5009:TCP"= 5009:TCP:TCP Port 5009
    "5010:TCP"= 5010:TCP:TCP Port 5010
    "5011:TCP"= 5011:TCP:TCP Port 5011
    "5012:TCP"= 5012:TCP:TCP Port 5012
    "5013:TCP"= 5013:TCP:TCP Port 5013
    "5014:TCP"= 5014:TCP:TCP Port 5014
    "5015:TCP"= 5015:TCP:TCP Port 5015
    "5016:TCP"= 5016:TCP:TCP Port 5016
    "5017:TCP"= 5017:TCP:TCP Port 5017
    "5018:TCP"= 5018:TCP:TCP Port 5018
    "5019:TCP"= 5019:TCP:TCP Port 5019
    "5020:TCP"= 5020:TCP:TCP Port 5020

    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
    S1 nlknhknb;nlknhknb;\??\c:\windows\system32\drivers\nlknhknb.sys --> c:\windows\system32\drivers\nlknhknb.sys [?]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

    2009-03-25 c:\windows\Tasks\Master Data Backup.job
    - c:\windows\system32\ntbackup.exe [2001-08-17 22:36]

    2009-03-28 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{adf3ac2b-fd74-496e-8774-90fbe20485e3} - c:\windows\system32\gnopoh.dll
    BHO-{dfd9ff15-b81b-4eb0-9de6-1ea58e67c37b} - c:\windows\system32\loditija.dll
    HKLM-Run-803af65a - c:\windows\system32\nafugizu.dll
    HKLM-Run-CmUsbSound - cmcnfgu.cpl
    SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\nobizoze.dll
    MSConfigStartUp-CmUsbSound - cmcnfgu.cpl


    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
    LSP: c:\windows\TEMP\ntdll64.dll
    DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} - hxxp://coolsavings.coupons.smartsource.com/download/cscmv5X.cab
    DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} - hxxp://offers.e-centives.com/cif/download/bin/actxcab.cab
    FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-28 11:55:36
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...


    c:\windows\system32\win32hlp.cnf 458 bytes

    scan completed successfully
    hidden files: 1

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
    "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\c2e18175]
    "ImagePath"="\SystemRoot\System32\drivers\c2e18175.sys"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(888)
    c:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgamsvr.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgupsvc.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgemc.exe
    c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    c:\program files\Dell\QuickSet\NicConfigSvc.exe
    c:\windows\system32\sessmgr.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\windows\system32\locator.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\dlcgcoms.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\rundll32.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2009-03-28 12:00:06 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-03-28 17:00:03

    Pre-Run: 29,167,935,488 bytes free
    Post-Run: 29,372,616,704 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    326 --- E O F --- 2009-03-13 03:02:38

  9. #9
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Please move ComFxx.exe file to root of your c: drive (c:\).



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Driver::
    nlknhknb
    c2e18175
    
    File::
    c:\windows\system32\wilumoni.exe
    c:\windows\oqemosar.dll
    C:\pvnncaoo.exe
    c:\windows\system32\drivers\c2e18175.sys
    C:\aywbok.exe
    c:\windows\Skanagakusadiyu.dll
    C:\qurdchd.exe
    C:\lvsen.exe
    C:\qvmkk.exe
    C:\stjr.exe
    C:\gosfrwtt.exe
    C:\-2143619339
    c:\windows\instsp2.exe
    c:\windows\system32\romopifo.dll
    c:\windows\system32\nekigese.dll
    c:\windows\system32\derinade.dll
    c:\windows\system32\drivers\nlknhknb.sys
    c:\windows\system32\win32hlp.cnf
    
    RegLock::
    [HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
    
    Regnull::
    [HKEY_USERS\s-1-5-21-2167828734-983198313-523243058-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1D8B72E2-795B-0749-7F39-10EF14076063}*]
    
    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Bxegagecaguhim"=-
    
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=-
    
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=-
    
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=-

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Refering to the picture above, drag CFScript into ComFxx.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Uninstall old Adobe Reader versions and get the latest one here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader!


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 13.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version. Uncheck MSN toolbar if it's offered there.




    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here. If you get a message that latest Java must be installed "enable" the Java add-ons in IE7. Do that using "manage add-ons" from the IE7 toolbar.


    Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  10. #10
    Junior Member
    Join Date
    Mar 2009
    Posts
    16

    Default

    Thank you. I have followed the directions in order. Below is the ComboFix log and I have attached the Kaspersky and new DDS logs as well. I also uninstalled my old adobe reader and Java Runtime updates and installed the newest version of each.

    ComboFix 09-03-28.06 - 2009-03-29 12:05:54.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.429 [GMT -5:00]
    Running from: C:\ComFxx.exe
    Command switches used :: C:\CFScript.txt
    AV: *On-access scanning disabled* (Outdated)
    AV: AVG 7.5.557 *On-access scanning disabled* (Outdated)
    FW: *disabled*
    * Created a new restore point

    FILE ::
    C:\-2143619339
    C:\aywbok.exe
    C:\gosfrwtt.exe
    C:\lvsen.exe
    C:\pvnncaoo.exe
    C:\qurdchd.exe
    C:\qvmkk.exe
    C:\stjr.exe
    c:\windows\instsp2.exe
    c:\windows\oqemosar.dll
    c:\windows\Skanagakusadiyu.dll
    c:\windows\system32\derinade.dll
    c:\windows\system32\drivers\c2e18175.sys
    c:\windows\system32\drivers\nlknhknb.sys
    c:\windows\system32\nekigese.dll
    c:\windows\system32\romopifo.dll
    c:\windows\system32\wilumoni.exe
    c:\windows\system32\win32hlp.cnf
    .
    Error: Cfolders.dat

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\-2143619339
    C:\aywbok.exe
    C:\gosfrwtt.exe
    C:\lvsen.exe
    C:\pvnncaoo.exe
    C:\qurdchd.exe
    C:\qvmkk.exe
    C:\stjr.exe
    c:\windows\instsp2.exe
    c:\windows\oqemosar.dll
    c:\windows\Skanagakusadiyu.dll
    c:\windows\system32\derinade.dll
    c:\windows\system32\drivers\c2e18175.sys
    c:\windows\system32\nekigese.dll
    c:\windows\system32\romopifo.dll
    c:\windows\system32\veyetidi.dll
    c:\windows\system32\wilumoni.exe
    c:\windows\system32\win32hlp.cnf
    F:\AUTORUN.INF

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_c2e18175
    -------\Service_nlknhknb


    ((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
    .

    2009-03-28 10:20 . 2009-03-29 12:04 2,936,847 -ra------ C:\ComFxx.exe
    2009-03-25 23:59 . 2009-03-25 23:59 <DIR> d-------- c:\program files\ERUNT
    2009-03-25 18:36 . 2009-03-25 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AVG7
    2009-03-25 17:51 . 2006-07-12 08:31 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
    2009-03-25 17:51 . 2007-05-30 21:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intel
    2009-03-25 17:51 . 2006-07-12 08:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ATI
    2009-03-25 17:51 . 2009-03-25 17:51 <DIR> d-------- c:\documents and settings\Administrator
    2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy
    2009-03-21 09:49 . 2009-03-21 09:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-03-21 08:43 . 2009-03-21 08:43 46,524 --ah----- c:\windows\system32\mlfcache.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-29 17:11 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
    2009-03-25 16:26 --------- d-----w c:\program files\Dl_cats
    2009-03-21 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\GTek
    2009-03-05 03:35 --------- d-----w c:\program files\Common Files\Adobe AIR
    2009-02-15 05:43 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\dvdcss
    2009-02-15 05:42 --------- d-----w c:\program files\VideoLAN
    2009-02-13 03:13 --------- d-----w c:\documents and settings\Scott & Jenni Kailey\Application Data\Move Networks
    2007-04-19 01:08 44,408 ------w c:\documents and settings\Scott & Jenni Kailey\Application Data\GDIPFONTCACHEV1.DAT
    2006-09-18 01:33 563,712 ------w c:\documents and settings\Scott & Jenni Kailey\gotomypc_370.exe
    2008-09-05 11:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090520080906\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_CC"="c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe" [2009-02-26 590848]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
    "dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2005-10-20 425984]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
    "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
    "DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 73728]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-09-07 180269]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="c:\progra~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 219136]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-12 24576]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDxVGAUTIL]
    --a------ 2007-08-01 11:41 237568 c:\windows\system32\Tdxvgautil.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "BITS"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avginet.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe"=
    "c:\\WINDOWS\\system32\\dlcgcoms.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlcgpswx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\ftp.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgamsvr.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgcc.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\GameHouse\\BounceOut\\BounceOut.exe"=
    "c:\\Program Files\\SopCast\\SopCast.exe"=
    "c:\\Documents and Settings\\Scott & Jenni Kailey\\Application Data\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\Digital Line Detect\\DLG.exe"=
    "c:\\Program Files\\Dell\\QuickSet\\NicConfigSvc.exe"=
    "c:\\Program Files\\Grisoft\\AVG Free\\avgupsvc.exe"=
    "c:\\Program Files\\Windows Defender\\MsMpEng.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "135:TCP"= 135:TCP:TCP Port 135
    "5000:TCP"= 5000:TCP:TCP Port 5000
    "5001:TCP"= 5001:TCP:TCP Port 5001
    "5002:TCP"= 5002:TCP:TCP Port 5002
    "5003:TCP"= 5003:TCP:TCP Port 5003
    "5004:TCP"= 5004:TCP:TCP Port 5004
    "5005:TCP"= 5005:TCP:TCP Port 5005
    "5006:TCP"= 5006:TCP:TCP Port 5006
    "5007:TCP"= 5007:TCP:TCP Port 5007
    "5008:TCP"= 5008:TCP:TCP Port 5008
    "5009:TCP"= 5009:TCP:TCP Port 5009
    "5010:TCP"= 5010:TCP:TCP Port 5010
    "5011:TCP"= 5011:TCP:TCP Port 5011
    "5012:TCP"= 5012:TCP:TCP Port 5012
    "5013:TCP"= 5013:TCP:TCP Port 5013
    "5014:TCP"= 5014:TCP:TCP Port 5014
    "5015:TCP"= 5015:TCP:TCP Port 5015
    "5016:TCP"= 5016:TCP:TCP Port 5016
    "5017:TCP"= 5017:TCP:TCP Port 5017
    "5018:TCP"= 5018:TCP:TCP Port 5018
    "5019:TCP"= 5019:TCP:TCP Port 5019
    "5020:TCP"= 5020:TCP:TCP Port 5020

    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\drivers\TdxMrMini.sys [2008-01-26 249600]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\drivers\TdxVgaMini.sys [2008-01-26 252160]
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.sys [2008-01-26 27135]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.SYS [2008-01-26 33280]
    S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

    2009-03-25 c:\windows\Tasks\Master Data Backup.job
    - c:\windows\system32\ntbackup.exe [2001-08-17 22:36]

    2009-03-29 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://fp.bankshare.info/my.logon.php3
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyServer = 128.238.88.64:3128
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
    LSP: c:\windows\TEMP\ntdll64.dll
    FF - ProfilePath - c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.com
    FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}\plugins\NPCpnMgr.dll
    FF - plugin: c:\documents and settings\Scott & Jenni Kailey\Application Data\Mozilla\Firefox\Profiles\px8ns5f7.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071102000004.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-29 12:12:03
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,RunDLLEntry???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
    "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(880)
    c:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgamsvr.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgupsvc.exe
    c:\progra~1\Grisoft\AVGFRE~1\avgemc.exe
    c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    c:\program files\Dell\QuickSet\NicConfigSvc.exe
    c:\windows\system32\sessmgr.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\windows\system32\locator.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\dlcgcoms.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2009-03-29 12:19:27 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-03-29 17:19:18
    ComboFix2.txt 2009-03-28 17:00:07

    Pre-Run: 29,459,685,376 bytes free
    Post-Run: 29,442,879,488 bytes free

    238 --- E O F --- 2009-03-13 03:02:38

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •