Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Click.Giftload removal problem

  1. #1
    Junior Member
    Join Date
    Mar 2011
    Posts
    5

    Default Click.Giftload removal problem

    Seems to be quite a few folks with the same problem as I have. Before downloading and using Spybot, I removed and slaved this drive to another computer via USB adapter and ran Norton AV on it. Removed multiple and various viruses, trojans and worms. Downloaded and copied over Kaspersky AV, Malware Bytes and Spybot. Put drive back into this computer and installed/ran Malware Bytes and Spybot with online updates. Again multiple infections removed. Installed and ran Kaspersky, several more threats removed. Ran Malware Bytes (no threats) and Spybot (Click.Giftload again found and keeps showing up each reboot). Found this forum and downloaded DDS and GMER (neither run at this point and GMER never run as of this post) and also McAfee's Stinger program. Ran Stinger, in log only mode, which found Artemis! "trojan" within both DDS and GMER files. Research indicated these may be false positives due to the nature of DDS and GMER (I hope so at any rate).

    Finally ran ERUNT then DDS, results as copied below and attached per instructions:


    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Administrator at 10:34:31.40 on Sun 03/27/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.354 [GMT -4:00]
    .
    AV: Bell Internet Security Services Anti-Virus *Enabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    AV: Kaspersky Anti-Virus *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Bell Internet Security Services Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdjcoms.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Bell\Internet Service Advisor\ServicepointService.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Personal Vault Backup Manager\VaultClientSRV.exe
    C:\Program Files\Personal Vault Backup Manager\VaultClientUpgrade.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
    C:\Program Files\BellCanada\McciTrayApp.exe
    C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Bell\Internet Service Advisor\BISA.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Bell\Internet Service Advisor\BISAComHandler.exe
    C:\Documents and Settings\Administrator\Desktop\dds.com
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uInternet Connection Wizard,ShellNext = iexplore
    uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
    uURLSearchHooks: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\ievkbd.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: OfferBox: {fc0d62c2-9640-4aeb-a5d5-cf25df11fa8c} - c:\program files\offerbox\OfferBoxBHO.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    TB: FrostWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: {47D66F71-DAC2-439C-836D-18C055AF389C} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150596.exe -Update -1150596 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; InfoPath.1)" -"http://www.shockwave.com/gamelanding/freakairmotocross.jsp"
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [lxdjmon.exe] "c:\program files\lexmark 1400 series\lxdjmon.exe"
    mRun: [lxdjamon] "c:\program files\lexmark 1400 series\lxdjamon.exe"
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
    mRun: [BellCanada_McciTrayApp] "c:\program files\bellcanada\McciTrayApp.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
    mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [BISA.exe] "c:\program files\bell\internet service advisor\BISA.exe" /AUTORUN
    mRun: [LXDJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXDJtime.dll,_RunDLLEntry@16
    mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236443587093
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1237937701445&h=3fa975773bdbe61cca6c85021f8f23b0/&filename=jinstall-6u13-windows-i586-jc.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
    DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    Notify: igfxcui - igfxsrvc.dll
    Notify: klogon - c:\windows\system32\klogon.dll
    AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2010-6-9 132184]
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-3-11 25608]
    R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352]
    R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-3-25 475736]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2010-5-7 32856]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19472]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSDriver.sys [2010-3-11 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSfilter.sys [2010-3-11 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSShim.sys [2010-3-11 25736]
    .
    =============== Created Last 30 ================
    .
    2011-03-26 23:51:19 -------- d-----w- c:\docume~1\admini~1\applic~1\Windows Desktop Search
    2011-03-26 23:49:18 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49:17 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47:17 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47:17 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47:17 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30:24 -------- d-sh--w- c:\documents and settings\administrator\IECompatCache
    2011-03-26 22:29:03 -------- d-sh--w- c:\documents and settings\administrator\PrivacIE
    2011-03-26 22:07:25 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
    2011-03-26 21:56:22 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:55:38 -------- d-----w- c:\windows\ie8updates
    2011-03-26 21:54:21 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54:19 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54:18 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45:21 -------- dc-h--w- c:\windows\ie8
    2011-03-26 02:13:06 114243 ----a-w- c:\windows\system32\drivers\klin.dat
    2011-03-26 02:13:02 97859 ----a-w- c:\windows\system32\drivers\klick.dat
    2011-03-26 02:08:35 -------- d-----w- c:\program files\Kaspersky Lab
    2011-03-26 02:08:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
    2011-03-26 02:02:31 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
    2011-03-25 12:09:22 -------- d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
    2011-03-25 12:08:11 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08:10 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-03-25 12:08:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56:26 -------- d-----w- C:\Downloads
    2011-03-20 23:01:33 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-20 23:01:31 -------- d-----w- c:\docume~1\admini~1\locals~1\applic~1\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}
    2011-03-20 23:00:34 -------- d-----w- c:\docume~1\admini~1\applic~1\OfferBox
    2011-03-20 23:00:28 -------- d-----w- c:\program files\OfferBox
    2011-03-20 23:00:11 -------- d-----w- c:\docume~1\admini~1\applic~1\364B336A674BEA09D1C5B17A4983100D
    2011-03-10 21:31:09 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29:46 -------- d-----w- C:\hairafter simply 2010
    2011-03-05 02:34:41 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-03-02 00:17:30 1529042 ----a-w- c:\documents and settings\all users\SPL309.tmp
    .
    ==================== Find3M ====================
    .
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys
    .
    ============= FINISH: 10:51:45.46 ===============

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    DNA
    Frostwire


    I'd like you to read this thread.

    Please uninstall the programs listed above (in red). Post back fresh dds logs.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Mar 2011
    Posts
    5

    Default Yet another click.giftload infection

    I have removed the P2P programs as requested and have rerun DDS - please see below. Spybot results are attached as well. Thanks!

    DDS.txt
    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Administrator at 21:32:33.76 on Fri 04/01/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.331 [GMT -4:00]
    .
    AV: Bell Internet Security Services Anti-Virus *Enabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    AV: Kaspersky Anti-Virus *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Bell Internet Security Services Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
    C:\Program Files\BellCanada\McciTrayApp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Bell\Internet Service Advisor\BISA.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
    C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdjcoms.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Bell\Internet Service Advisor\ServicepointService.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Personal Vault Backup Manager\VaultClientSRV.exe
    C:\Program Files\Personal Vault Backup Manager\VaultClientUpgrade.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Bell\Internet Service Advisor\BISAComHandler.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Administrator\Desktop\dds.com
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uInternet Connection Wizard,ShellNext = iexplore
    uURLSearchHooks: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\ievkbd.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    TB: {47D66F71-DAC2-439C-836D-18C055AF389C} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1150596.exe -Update -1150596 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; InfoPath.1)" -"http://www.shockwave.com/gamelanding/freakairmotocross.jsp"
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [lxdjmon.exe] "c:\program files\lexmark 1400 series\lxdjmon.exe"
    mRun: [lxdjamon] "c:\program files\lexmark 1400 series\lxdjamon.exe"
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
    mRun: [BellCanada_McciTrayApp] "c:\program files\bellcanada\McciTrayApp.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
    mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [BISA.exe] "c:\program files\bell\internet service advisor\BISA.exe" /AUTORUN
    mRun: [LXDJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXDJtime.dll,_RunDLLEntry@16
    mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236443587093
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1237937701445&h=3fa975773bdbe61cca6c85021f8f23b0/&filename=jinstall-6u13-windows-i586-jc.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
    DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    Notify: igfxcui - igfxsrvc.dll
    Notify: klogon - c:\windows\system32\klogon.dll
    AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2010-6-9 132184]
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-3-11 25608]
    R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352]
    R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-3-25 475736]
    R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe [2010-11-2 365336]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
    R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\bell\bell internet security services\RpsSecurityAwareR.exe [2010-1-18 165408]
    R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\bell\bell internet security services\avg\identity protection\agent\bin\AVGIDSAgent.exe [2010-3-11 5832712]
    R2 ServicepointService;ServicepointService;c:\program files\bell\internet service advisor\ServicepointService.exe [2011-3-20 689464]
    R2 VaultClientSRV;Personal Vault Backup Manager Service;c:\program files\personal vault backup manager\VaultClientSRV.exe [2010-1-17 1051728]
    R2 VaultClientUpgrade;Personal Vault Backup Manager Upgrade Service;c:\program files\personal vault backup manager\VaultClientUpgrade.exe [2010-1-17 56400]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2010-5-7 32856]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19472]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSDriver.sys [2010-3-11 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSfilter.sys [2010-3-11 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSShim.sys [2010-3-11 25736]
    S2 gupdate1ca1861b33e0b04;Google Update Service (gupdate1ca1861b33e0b04);c:\program files\google\update\GoogleUpdate.exe [2009-8-8 133104]
    .
    =============== Created Last 30 ================
    .
    2011-03-26 23:51:19 -------- d-----w- c:\docume~1\admini~1\applic~1\Windows Desktop Search
    2011-03-26 23:49:18 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49:17 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47:17 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47:17 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47:17 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30:24 -------- d-sh--w- c:\documents and settings\administrator\IECompatCache
    2011-03-26 22:29:03 -------- d-sh--w- c:\documents and settings\administrator\PrivacIE
    2011-03-26 22:07:25 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
    2011-03-26 21:56:22 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:55:38 -------- d-----w- c:\windows\ie8updates
    2011-03-26 21:54:21 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54:19 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54:18 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45:21 -------- dc-h--w- c:\windows\ie8
    2011-03-26 02:13:06 114243 ----a-w- c:\windows\system32\drivers\klin.dat
    2011-03-26 02:13:02 97859 ----a-w- c:\windows\system32\drivers\klick.dat
    2011-03-26 02:08:35 -------- d-----w- c:\program files\Kaspersky Lab
    2011-03-26 02:08:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
    2011-03-26 02:02:31 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
    2011-03-25 12:09:22 -------- d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
    2011-03-25 12:08:11 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08:10 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-03-25 12:08:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56:26 -------- d-----w- C:\Downloads
    2011-03-20 23:01:33 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-20 23:01:31 -------- d-----w- c:\docume~1\admini~1\locals~1\applic~1\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}
    2011-03-20 23:00:34 -------- d-----w- c:\docume~1\admini~1\applic~1\OfferBox
    2011-03-20 23:00:11 -------- d-----w- c:\docume~1\admini~1\applic~1\364B336A674BEA09D1C5B17A4983100D
    2011-03-10 21:31:09 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29:46 -------- d-----w- C:\hairafter simply 2010
    2011-03-05 02:34:41 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    .
    ==================== Find3M ====================
    .
    2011-03-02 00:17:30 1529042 ----a-w- c:\documents and settings\all users\SPL309.tmp
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
    .
    ============= FINISH: 21:40:53.46 ===============


    Spybot Results

    --- Report generated: 2011-04-01 10:26 ---

    Click.GiftLoad: [SBI $89783858] User settings (Registry value, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION\svchost.exe


    --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
    Last edited by tashi; 2011-04-02 at 05:01. Reason: Merged two topics

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    You should have one antivirus program installed only. Please decide between these two you're currently running there:
    Bell Internet Security Services
    Kaspersky Anti-Virus 2011




    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully first.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Mar 2011
    Posts
    5

    Default ComboFix and new DDS logs

    Hyvaa huomenta Blade!

    Attached is the latest DDS logs and Attach zip, plus the results of ComboFix.

    Kiitos,


    DDS
    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Administrator at 20:42:17.04 on Sun 04/03/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.169 [GMT -4:00]
    .
    AV: Bell Internet Security Services Anti-Virus *Enabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    FW: Bell Internet Security Services Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdjcoms.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Bell\Internet Service Advisor\ServicepointService.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Personal Vault Backup Manager\VaultClientSRV.exe
    C:\Program Files\Personal Vault Backup Manager\VaultClientUpgrade.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
    C:\Program Files\BellCanada\McciTrayApp.exe
    C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
    C:\Program Files\Carbonite\CarbonitePreinstaller.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Bell\Internet Service Advisor\BISA.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Bell\Internet Service Advisor\BISAComHandler.exe
    C:\Program Files\Bell\Bell Internet Security Services\RPS.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSMonitor.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Administrator\Desktop\dds.com
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Connection Wizard,ShellNext = iexplore
    uURLSearchHooks: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [lxdjamon] "c:\program files\lexmark 1400 series\lxdjamon.exe"
    mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
    mRun: [BellCanada_McciTrayApp] "c:\program files\bellcanada\McciTrayApp.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
    mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [BISA.exe] "c:\program files\bell\internet service advisor\BISA.exe" /AUTORUN
    mRun: [LXDJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXDJtime.dll,_RunDLLEntry@16
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236443587093
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1237937701445&h=3fa975773bdbe61cca6c85021f8f23b0/&filename=jinstall-6u13-windows-i586-jc.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
    DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    Notify: igfxcui - igfxsrvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-3-11 25608]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
    R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\bell\bell internet security services\RpsSecurityAwareR.exe [2010-1-18 165408]
    R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\bell\bell internet security services\avg\identity protection\agent\bin\AVGIDSAgent.exe [2010-3-11 5832712]
    R2 ServicepointService;ServicepointService;c:\program files\bell\internet service advisor\ServicepointService.exe [2011-3-20 689464]
    R2 VaultClientSRV;Personal Vault Backup Manager Service;c:\program files\personal vault backup manager\VaultClientSRV.exe [2010-1-17 1051728]
    R2 VaultClientUpgrade;Personal Vault Backup Manager Upgrade Service;c:\program files\personal vault backup manager\VaultClientUpgrade.exe [2010-1-17 56400]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSDriver.sys [2010-3-11 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSfilter.sys [2010-3-11 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSShim.sys [2010-3-11 25736]
    S2 gupdate1ca1861b33e0b04;Google Update Service (gupdate1ca1861b33e0b04);c:\program files\google\update\GoogleUpdate.exe [2009-8-8 133104]
    .
    =============== Created Last 30 ================
    .
    2011-04-04 00:38:47 -------- d-----w- c:\docume~1\admini~1\applic~1\PriceGong
    2011-04-03 22:49:17 -------- d-sha-r- C:\cmdcons
    2011-04-03 22:40:18 98816 ----a-w- c:\windows\sed.exe
    2011-04-03 22:40:18 89088 ----a-w- c:\windows\MBR.exe
    2011-04-03 22:40:18 256512 ----a-w- c:\windows\PEV.exe
    2011-04-03 22:40:18 161792 ----a-w- c:\windows\SWREG.exe
    2011-03-26 23:51:19 -------- d-----w- c:\docume~1\admini~1\applic~1\Windows Desktop Search
    2011-03-26 23:49:18 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49:17 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47:17 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47:17 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47:17 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30:24 -------- d-sh--w- c:\documents and settings\administrator\IECompatCache
    2011-03-26 22:29:03 -------- d-sh--w- c:\documents and settings\administrator\PrivacIE
    2011-03-26 22:07:25 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
    2011-03-26 21:56:22 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:55:38 -------- d-----w- c:\windows\ie8updates
    2011-03-26 21:54:21 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54:19 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54:18 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45:21 -------- dc-h--w- c:\windows\ie8
    2011-03-26 02:08:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
    2011-03-25 12:09:22 -------- d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
    2011-03-25 12:08:11 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08:10 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-03-25 12:08:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56:26 -------- d-----w- C:\Downloads
    2011-03-20 23:01:33 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-10 21:31:09 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29:46 -------- d-----w- C:\hairafter simply 2010
    2011-03-05 02:34:41 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    .
    ==================== Find3M ====================
    .
    2011-03-02 00:17:30 1529042 ----a-w- c:\documents and settings\all users\SPL309.tmp
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
    .
    ============= FINISH: 20:45:39.21 ===============




    ComboFix

    ComboFix 11-04-03.01 - Administrator 04/03/2011 18:54:40.1.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.298 [GMT -4:00]
    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
    AV: Bell Internet Security Services Anti-Virus *Disabled/Outdated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    AV: Kaspersky Anti-Virus *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Bell Internet Security Services Firewall *Disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Administrator\Application Data\364B336A674BEA09D1C5B17A4983100D
    c:\documents and settings\Administrator\Application Data\364B336A674BEA09D1C5B17A4983100D\enemies-names.txt
    c:\documents and settings\Administrator\Application Data\364B336A674BEA09D1C5B17A4983100D\local.ini
    c:\documents and settings\Administrator\Application Data\Adobe\plugs
    c:\documents and settings\Administrator\Application Data\OfferBox
    c:\documents and settings\Administrator\Application Data\OfferBox\config.xml
    c:\documents and settings\Administrator\Application Data\PriceGong
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\Administrator\Local Settings\Application Data\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}
    c:\documents and settings\Administrator\Local Settings\Application Data\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}\chrome.manifest
    c:\documents and settings\Administrator\Local Settings\Application Data\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}\chrome\content\_cfg.js
    c:\documents and settings\Administrator\Local Settings\Application Data\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}\chrome\content\overlay.xul
    c:\documents and settings\Administrator\Local Settings\Application Data\{340C64C7-4912-4EC2-8EC7-8DD04B1B8B1A}\install.rdf
    c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk
    C:\install.exe
    c:\windows\system32\Install.txt
    c:\windows\system32\tukdtjsr.txt
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_WMPNetworkSvc
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-03-03 to 2011-04-03 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-01 21:04 . 2011-04-01 21:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2011-03-26 23:54 . 2011-03-26 23:54 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-03-26 23:51 . 2011-03-26 23:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Desktop Search
    2011-03-26 23:49 . 2011-03-28 03:22 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49 . 2011-03-26 23:49 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30 . 2011-03-26 22:30 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
    2011-03-26 22:29 . 2011-03-26 22:29 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
    2011-03-26 22:07 . 2011-03-26 22:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2011-03-26 22:07 . 2011-03-26 22:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-03-26 21:56 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:54 . 2010-12-20 23:59 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54 . 2010-12-20 23:59 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54 . 2010-12-20 23:59 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45 . 2011-03-26 21:53 -------- dc-h--w- c:\windows\ie8
    2011-03-26 04:08 . 2011-03-26 04:11 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-03-26 02:13 . 2011-03-26 04:18 114243 ----a-w- c:\windows\system32\drivers\klin.dat
    2011-03-26 02:13 . 2011-03-26 04:18 97859 ----a-w- c:\windows\system32\drivers\klick.dat
    2011-03-26 02:08 . 2011-03-26 02:08 -------- d-----w- c:\program files\Kaspersky Lab
    2011-03-26 02:08 . 2011-04-03 23:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
    2011-03-26 02:02 . 2011-03-26 02:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
    2011-03-25 12:09 . 2011-03-25 12:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2011-03-25 12:08 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08 . 2011-03-25 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-03-25 12:08 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08 . 2011-03-25 12:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56 . 2011-03-26 17:31 -------- d-----w- C:\Downloads
    2011-03-20 23:01 . 2011-03-21 11:09 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-10 21:31 . 2011-03-10 21:32 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29 . 2011-03-08 00:30 -------- d-----w- C:\hairafter simply 2010
    2011-03-05 02:34 . 2011-03-05 02:34 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-02 00:17 . 2011-03-02 00:17 1529042 ----a-w- c:\documents and settings\All Users\SPL309.tmp
    2011-02-09 13:53 . 2004-08-04 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-04 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58 . 2009-03-06 04:58 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57 . 2009-03-06 04:58 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44 . 2004-08-04 12:00 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09 . 2004-08-04 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    2011-01-17 14:54 175912 ----a-w- c:\program files\Query_Master_1.5\prxtbQue0.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{DCD67E84-F5CD-456F-98E7-3A18D4EEB888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VaultIcon1]
    @="{B976888E-DC7B-456C-A62F-44EA07ED231F}"
    [HKEY_CLASSES_ROOT\CLSID\{B976888E-DC7B-456C-A62F-44EA07ED231F}]
    2010-01-17 23:08 503808 ----a-w- c:\program files\Personal Vault Backup Manager\VaultClientMenu.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-10 118784]
    "SoundMan"="SOUNDMAN.EXE" [2006-01-11 577536]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-24 148888]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "lxdjamon"="c:\program files\Lexmark 1400 Series\lxdjamon.exe" [2007-03-06 20480]
    "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
    "BellCanada_McciTrayApp"="c:\program files\BellCanada\McciTrayApp.exe" [2010-01-19 1565696]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 185640]
    "CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
    "BISA.exe"="c:\program files\Bell\Internet Service Advisor\BISA.exe" [2011-01-06 4318520]
    "LXDJCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXDJtime.dll" [2007-02-09 102400]
    "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe" [2010-11-03 365336]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2005-05-12 03:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-11-18 01:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 16:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    2009-06-07 22:09 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Bonjour Service"=2 (0x2)
    "aawservice"=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\WINDOWS\\system32\\lxdjcoms.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\lxdjamon.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\App4R.exe"=
    "c:\\WINDOWS\\system32\\lxdjcfg.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjwbgw.exe"=
    "c:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\Wireless\\lxdjwpss.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjpswx.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjjswx.exe"=
    "c:\\Program Files\\Bell\\Internet Service Advisor\\ServicepointService.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjtime.exe"=
    .
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [3/11/2010 7:53 AM 25608]
    R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [6/9/2010 4:43 PM 11352]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [5/1/2009 3:35 PM 181544]
    R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe [1/18/2010 5:11 PM 165408]
    R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe [3/11/2010 7:53 AM 5832712]
    R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/7/2010 11:06 AM 32856]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [11/2/2009 7:27 PM 19472]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [3/11/2010 7:53 AM 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys [3/11/2010 7:53 AM 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [3/11/2010 7:53 AM 25736]
    S2 gupdate1ca1861b33e0b04;Google Update Service (gupdate1ca1861b33e0b04);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2009 3:52 PM 133104]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - E022CCAC
    *Deregistered* - e022ccac
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan sysagent
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    2011-04-03 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-07 19:49]
    .
    2011-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 19:51]
    .
    2011-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 19:51]
    .
    2011-04-03 c:\windows\Tasks\ParetoLogic Registration.job
    - c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2010-07-05 22:00]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Connection Wizard,ShellNext = iexplore
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    HKLM-Run-lxdjmon.exe - c:\program files\Lexmark 1400 Series\lxdjmon.exe
    MSConfigStartUp-Dlowikazubijax - c:\windows\ohedikugomuk.dll
    MSConfigStartUp-Nyutukuw - c:\windows\a201640.dll
    MSConfigStartUp-tukdtjsr - c:\windows\system32\tukdtjsr.exe
    MSConfigStartUp-tukdtjsrx - c:\windows\system32\tukdtjsrx.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-04-03 19:29
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXDJCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXDJtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1177238915-1292428093-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (Administrator)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,6a,90,89,ee,ed,53,40,9c,e5,51,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,6a,90,89,ee,ed,53,40,9c,e5,51,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'explorer.exe'(2060)
    c:\windows\system32\WININET.dll
    c:\program files\Personal Vault Backup Manager\VaultClientMenu.dll
    c:\program files\Personal Vault Backup Manager\LIBEXPAT.dll
    c:\program files\Personal Vault Backup Manager\VaultClientCOM.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
    c:\program files\Windows Desktop Search\deskbar.dll
    c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
    c:\program files\Windows Desktop Search\dbres.dll
    c:\program files\Windows Desktop Search\wordwheel.dll
    c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
    c:\program files\Windows Desktop Search\msnlExtRes.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Bell\Bell Internet Security Services\Fws.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\lxdjcoms.exe
    c:\program files\Common Files\Motive\McciCMService.exe
    c:\windows\SOUNDMAN.EXE
    c:\windows\system32\HPZipm12.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Bell\Internet Service Advisor\ServicepointService.exe
    c:\program files\Personal Vault Backup Manager\VaultClientSRV.exe
    c:\program files\Personal Vault Backup Manager\VaultClientUpgrade.exe
    c:\windows\system32\SearchIndexer.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Bell\Internet Service Advisor\BISAComHandler.exe
    .
    **************************************************************************
    .
    Completion time: 2011-04-03 19:47:50 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-04-03 23:47
    .
    Pre-Run: 34,650,824,704 bytes free
    Post-Run: 34,660,724,736 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - 5828BF57F5C114C76906F3E6F7B4265B

  6. #6
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    DDS::
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    File::
    c:\windows\Prihihosoz.bin

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Uninstall old Adobe Reader versions and get the latest one ((Adobe Reader X + 10.0.1 update for it)) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.



    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 24.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u24-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



    * Go here to run an online scanner from ESET.
    • Note: You will need to use Internet explorer for this scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is not checkmarked.
    • Click Scan
    • Wait for the scan to finish.




    Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Junior Member
    Join Date
    Mar 2011
    Posts
    5

    Default

    Hey Blade,

    Here are the results from CFScript into ComboFix, DDS logs, and ESET. Truly, thanks for your help on this.

    Kiitos,


    ComboFix:

    ComboFix 11-04-03.01 - Administrator 04/04/2011 19:55:57.2.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.370 [GMT -4:00]
    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
    AV: Bell Internet Security Services Anti-Virus *Disabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    FW: Bell Internet Security Services Firewall *Disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}
    * Resident AV is active
    .
    .
    FILE ::
    "c:\windows\Prihihosoz.bin"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Administrator\Application Data\PriceGong
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Administrator\Application Data\PriceGong\Data\z.xml
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-03-05 to 2011-04-05 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-04 23:33 . 2011-04-04 23:34 -------- d-----w- c:\program files\Common Files\Adobe
    2011-04-04 22:55 . 2011-04-04 22:55 -------- d-----w- c:\program files\Common Files\Java
    2011-04-04 22:54 . 2011-04-04 22:53 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-04-04 22:53 . 2011-04-04 22:53 -------- d-----w- c:\program files\Java
    2011-04-04 22:36 . 2011-04-04 22:53 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-04-01 21:04 . 2011-04-01 21:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2011-03-26 23:54 . 2011-03-26 23:54 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-03-26 23:51 . 2011-03-26 23:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Desktop Search
    2011-03-26 23:49 . 2011-03-28 03:22 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49 . 2011-03-26 23:49 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30 . 2011-03-26 22:30 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
    2011-03-26 22:29 . 2011-03-26 22:29 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
    2011-03-26 22:07 . 2011-03-26 22:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2011-03-26 22:07 . 2011-03-26 22:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2011-03-26 21:56 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:54 . 2010-12-20 23:59 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54 . 2010-12-20 23:59 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54 . 2010-12-20 23:59 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45 . 2011-03-26 21:53 -------- dc-h--w- c:\windows\ie8
    2011-03-26 04:08 . 2011-03-26 04:11 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-03-26 02:08 . 2011-04-04 00:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
    2011-03-25 12:09 . 2011-03-25 12:09 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2011-03-25 12:08 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08 . 2011-03-25 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-03-25 12:08 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08 . 2011-03-25 12:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56 . 2011-03-26 17:31 -------- d-----w- C:\Downloads
    2011-03-20 23:01 . 2011-03-21 11:09 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-10 21:31 . 2011-03-10 21:32 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29 . 2011-03-08 00:30 -------- d-----w- C:\hairafter simply 2010
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-05 02:34 . 2011-03-05 02:34 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-03-02 00:17 . 2011-03-02 00:17 1529042 ----a-w- c:\documents and settings\All Users\SPL309.tmp
    2011-02-09 13:53 . 2004-08-04 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-04 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58 . 2009-03-06 04:58 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57 . 2009-03-06 04:58 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44 . 2004-08-04 12:00 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09 . 2004-08-04 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    2011-01-17 14:54 175912 ----a-w- c:\program files\Query_Master_1.5\prxtbQue0.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{DCD67E84-F5CD-456F-98E7-3A18D4EEB888}"= "c:\program files\Query_Master_1.5\prxtbQue0.dll" [2011-01-17 175912]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{dcd67e84-f5cd-456f-98e7-3a18d4eeb888}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VaultIcon1]
    @="{B976888E-DC7B-456C-A62F-44EA07ED231F}"
    [HKEY_CLASSES_ROOT\CLSID\{B976888E-DC7B-456C-A62F-44EA07ED231F}]
    2010-01-17 23:08 503808 ----a-w- c:\program files\Personal Vault Backup Manager\VaultClientMenu.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-10 118784]
    "SoundMan"="SOUNDMAN.EXE" [2006-01-11 577536]
    "lxdjamon"="c:\program files\Lexmark 1400 Series\lxdjamon.exe" [2007-03-06 20480]
    "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
    "BellCanada_McciTrayApp"="c:\program files\BellCanada\McciTrayApp.exe" [2010-01-19 1565696]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 185640]
    "CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
    "BISA.exe"="c:\program files\Bell\Internet Service Advisor\BISA.exe" [2011-01-06 4318520]
    "LXDJCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXDJtime.dll" [2007-02-09 102400]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2005-05-12 03:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-11-18 01:59 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 16:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    2009-06-07 22:09 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Bonjour Service"=2 (0x2)
    "aawservice"=2 (0x2)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\WINDOWS\\system32\\lxdjcoms.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\lxdjamon.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\App4R.exe"=
    "c:\\WINDOWS\\system32\\lxdjcfg.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjwbgw.exe"=
    "c:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"=
    "c:\\Program Files\\Lexmark 1400 Series\\Wireless\\lxdjwpss.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjpswx.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjjswx.exe"=
    "c:\\Program Files\\Bell\\Internet Service Advisor\\ServicepointService.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjtime.exe"=
    .
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [3/11/2010 7:53 AM 25608]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [5/1/2009 3:35 PM 181544]
    R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe [1/18/2010 5:11 PM 165408]
    R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe [3/11/2010 7:53 AM 5832712]
    R2 ServicepointService;ServicepointService;c:\program files\Bell\Internet Service Advisor\ServicepointService.exe [3/20/2011 6:47 PM 689464]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [3/11/2010 7:53 AM 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys [3/11/2010 7:53 AM 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [3/11/2010 7:53 AM 25736]
    S2 gupdate1ca1861b33e0b04;Google Update Service (gupdate1ca1861b33e0b04);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2009 3:52 PM 133104]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - ACBE451D
    *NewlyCreated* - JAVAQUICKSTARTERSERVICE
    *NewlyCreated* - NOSGETPLUSHELPER
    *Deregistered* - acbe451d
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bdx REG_MULTI_SZ scan sysagent
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-01 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    2011-04-04 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-07 19:49]
    .
    2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 19:51]
    .
    2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 19:51]
    .
    2011-04-03 c:\windows\Tasks\ParetoLogic Registration.job
    - c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2010-07-05 22:00]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Connection Wizard,ShellNext = iexplore
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-04-04 20:13
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    LXDJCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXDJtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1177238915-1292428093-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (Administrator)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,6a,90,89,ee,ed,53,40,9c,e5,51,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,6a,90,89,ee,ed,53,40,9c,e5,51,\
    .
    Completion time: 2011-04-04 20:22:21
    ComboFix-quarantined-files.txt 2011-04-05 00:22
    ComboFix2.txt 2011-04-03 23:47
    .
    Pre-Run: 34,425,294,848 bytes free
    Post-Run: 34,420,342,784 bytes free
    .
    - - End Of File - - C92572D6548FBBD2EDEE8B5342B93528


    DDS:

    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Administrator at 20:25:13.28 on Mon 04/04/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.766.271 [GMT -4:00]
    .
    AV: Bell Internet Security Services Anti-Virus *Disabled/Updated* {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
    FW: Bell Internet Security Services Firewall *Disabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
    svchost.exe
    svchost.exe
    C:\Program Files\Bell\Bell Internet Security Services\rps.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
    C:\WINDOWS\system32\lxdjcoms.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Bell\Internet Service Advisor\ServicepointService.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Personal Vault Backup Manager\VaultClientSRV.exe
    C:\Program Files\Personal Vault Backup Manager\VaultClientUpgrade.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
    C:\Program Files\BellCanada\McciTrayApp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\Bell\Internet Service Advisor\BISAComHandler.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSMonitor.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Administrator\Desktop\dds.com
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Connection Wizard,ShellNext = iexplore
    uURLSearchHooks: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Query Master 1.5 Toolbar: {dcd67e84-f5cd-456f-98e7-3a18d4eeb888} - c:\program files\query_master_1.5\prxtbQue0.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [lxdjamon] "c:\program files\lexmark 1400 series\lxdjamon.exe"
    mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
    mRun: [BellCanada_McciTrayApp] "c:\program files\bellcanada\McciTrayApp.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
    mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [BISA.exe] "c:\program files\bell\internet service advisor\BISA.exe" /AUTORUN
    mRun: [LXDJCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXDJtime.dll,_RunDLLEntry@16
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236443587093
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
    DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    Notify: igfxcui - igfxsrvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-3-11 25608]
    R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
    R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\bell\bell internet security services\RpsSecurityAwareR.exe [2010-1-18 165408]
    R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\bell\bell internet security services\avg\identity protection\agent\bin\AVGIDSAgent.exe [2010-3-11 5832712]
    R2 ServicepointService;ServicepointService;c:\program files\bell\internet service advisor\ServicepointService.exe [2011-3-20 689464]
    R2 VaultClientSRV;Personal Vault Backup Manager Service;c:\program files\personal vault backup manager\VaultClientSRV.exe [2010-1-17 1051728]
    R2 VaultClientUpgrade;Personal Vault Backup Manager Upgrade Service;c:\program files\personal vault backup manager\VaultClientUpgrade.exe [2010-1-17 56400]
    R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSDriver.sys [2010-3-11 122376]
    R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSfilter.sys [2010-3-11 30216]
    R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSShim.sys [2010-3-11 25736]
    S2 gupdate1ca1861b33e0b04;Google Update Service (gupdate1ca1861b33e0b04);c:\program files\google\update\GoogleUpdate.exe [2009-8-8 133104]
    S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
    .
    =============== Created Last 30 ================
    .
    2011-04-04 23:51:19 -------- d-----w- C:\ComboFix
    2011-04-04 22:54:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-04-04 22:36:46 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-04-03 22:49:17 -------- d-sha-r- C:\cmdcons
    2011-04-03 22:40:18 98816 ----a-w- c:\windows\sed.exe
    2011-04-03 22:40:18 89088 ----a-w- c:\windows\MBR.exe
    2011-04-03 22:40:18 256512 ----a-w- c:\windows\PEV.exe
    2011-04-03 22:40:18 161792 ----a-w- c:\windows\SWREG.exe
    2011-03-26 23:51:19 -------- d-----w- c:\docume~1\admini~1\applic~1\Windows Desktop Search
    2011-03-26 23:49:18 -------- d-----w- c:\program files\Windows Desktop Search
    2011-03-26 23:49:17 -------- d-----w- c:\windows\system32\GroupPolicy
    2011-03-26 23:47:17 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2011-03-26 23:47:17 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2011-03-26 23:47:17 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2011-03-26 22:30:24 -------- d-sh--w- c:\documents and settings\administrator\IECompatCache
    2011-03-26 22:29:03 -------- d-sh--w- c:\documents and settings\administrator\PrivacIE
    2011-03-26 22:07:25 -------- d-sh--w- c:\documents and settings\administrator\IETldCache
    2011-03-26 21:56:22 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2011-03-26 21:55:38 -------- d-----w- c:\windows\ie8updates
    2011-03-26 21:54:21 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2011-03-26 21:54:19 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2011-03-26 21:54:18 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2011-03-26 21:45:21 -------- dc-h--w- c:\windows\ie8
    2011-03-26 02:08:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
    2011-03-25 12:09:22 -------- d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
    2011-03-25 12:08:11 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-03-25 12:08:10 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-03-25 12:08:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-25 12:08:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-03-25 03:56:26 -------- d-----w- C:\Downloads
    2011-03-20 23:01:33 0 ----a-w- c:\windows\Prihihosoz.bin
    2011-03-10 21:31:09 -------- d-----w- c:\program files\Graboid
    2011-03-08 00:29:46 -------- d-----w- C:\hairafter simply 2010
    .
    ==================== Find3M ====================
    .
    2011-03-05 02:34:41 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
    2011-03-02 00:17:30 1529042 ----a-w- c:\documents and settings\all users\SPL309.tmp
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
    .
    ============= FINISH: 20:27:19.70 ===============


    ESET:

    C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\364B336A674BEA09D1C5B17A4983100D\enemies-names.txt.vir Win32/Adware.AntimalwareDoctor.AE.Gen application
    C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Application Data\364B336A674BEA09D1C5B17A4983100D\local.ini.vir Win32/Adware.AntimalwareDoctor.AE.Gen application
    C:\System Volume Information\_restore{BC5DBC1B-AD9F-4554-8EDA-44FA44230C1A}\RP704\A0070666.ini Win32/Adware.AntimalwareDoctor.AE.Gen application

  8. #8
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    ESET findings will be removed in a final stage. How's the system running now?
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  9. #9
    Junior Member
    Join Date
    Mar 2011
    Posts
    5

    Default

    Slow to boot and load programs, especially the Bell AV suite, (but I write that off mostly to the Celeron processor in this system), but I am not getting any browser redirects and overall things are faster than they were before your help.

    I will need to clean any infections from the Seagate backup drive when this is computer is clean. I know I will need to disable auto-start/auto-run and turn off the Seagate utility before plugging it in. But what would you recommend as the first step for cleaning it?

  10. #10
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    It might be worth trying some lighter antivirus solution.

    Good free antivirus programs are:
    Antivir and
    Avast!

    Good commercial ones are from:
    Kaspersky and
    ESET


    Defragging hard drive can sometimes also improve performance.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •