Malware removal help needed

alex76 · Dec 25, 2008

Just recently, i have been getting alot of registry changes from spybot search and destroy from C:windows/system32/Rundll32.exe . Also, my task manager has been at almost 90% usage, and alot of popups have been occuring when i use the internet. One more thing, i keep getting a fake antivirus scan 2009 claiming i have to download it, and when i click exit, it brings me to a page do a bogus scan. Please help

Here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:16:04 PM, on 12/25/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {B4BC1A65-FC1A-41E9-80CA-A6C4EC96943D} - (no file)
O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - (no file)
O2 - BHO: (no name) - {f74ce407-9cfc-4ce5-8c82-4ad1bbcccaf6} - C:\WINDOWS\system32\tepepife.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CPM93bf67fb] Rundll32.exe "c:\windows\system32\tolataga.dll",a
O4 - HKLM\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\MSN Messenger\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-19\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [BitTorrent DNA] "C:\Documents and Settings\homework\Program Files\DNA\btdna.exe" (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [Quick Hide Windows] (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [908c5467] rundll32.exe "C:\Documents and Settings\All Users\Application Data\ladilasa\ladilasa.dll",b (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [CPM93bf67fb] Rundll32.exe "c:\windows\system32\wojifizi.dll",a (User 'homework')
O4 - HKUS\S-1-5-21-3502044364-3353624888-3900326770-1010\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s (User 'homework')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-21-3502044364-3353624888-3900326770-1010 Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'homework')
O4 - S-1-5-21-3502044364-3353624888-3900326770-1010 User Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'homework')
O4 - S-1-5-18 Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164093190093
O20 - AppInit_DLLs: c:\windows\system32\nisinupo.dll ,C:\WINDOWS\system32\yuhisona.dll
O20 - Winlogon Notify: ssqppMgg - ssqppMgg.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 11636 bytes

peku006 · Dec 26, 2008

Hello and welcome to Safer Networking,

My name is peku006and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Please continue to respond until I give you the "All Clear"

If you follow these instructions, everything should go smoothly.

1 - Scan With ComboFix

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

2 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

3 - Status Check
Please reply with

1. the ComboFix log(C:\ComboFix.txt)
2. a fresh HijackThis log

Thanks peku006

alex76 · Dec 26, 2008

First off thanks for replying to my call for help Peku006. I am unsure of what system I am using. This is what the system properties state:

Microsoft Windows XP
Media center Edition
Version 2002
Service pack 3

I am unsure if i choose the service pack 2 download or the pro service 2 package.

peku006 · Dec 26, 2008

Hi alex76

You have Microsoft Windows XP with Service pack 3

alex76 · Dec 26, 2008

Sorry to be a bother, but i am still unsure of what exact file to download. It would be great if you could give me a direct link to download from. Thanks.

peku006 · Dec 26, 2008

Hi alex76

Windows XP Home Edition

Windows XP Professional

alex76 · Dec 26, 2008

Currently i have just rebooted my computer with combofix, and combofix seems to be stuck at the part while making a log report. I have waited for a long time and nothing has happened.

alex76 · Dec 26, 2008

Never mind the log has just appeared.

Combofix log

ComboFix 08-12-25.04 - Waiming Li 2008-12-26 8:33:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1422 [GMT -5:00]
Running from: c:\documents and settings\Waiming Li\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Waiming Li\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Waiming Li\Application Data\inst.exe
c:\windows\system32\dMWwayxx.ini2
c:\windows\system32\edifetus.ini
c:\windows\system32\eyulowof.ini
c:\windows\system32\feMUCcdd.ini
c:\windows\system32\feMUCcdd.ini2
c:\windows\system32\fowoluye.dll
c:\windows\system32\moheligo.dll
c:\windows\wiaserviv.log
c:\windows\wiaservv.log

.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.

2008-12-25 18:01 . 2008-12-25 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-25 17:29 . 2008-12-25 17:29 <DIR> d-------- c:\documents and settings\homework\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-25 09:02 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 18:05 . 2008-12-23 14:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\mezinoma
2008-12-22 18:05 . 2008-12-25 11:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\ladilasa
2008-12-22 18:05 . 2008-12-25 11:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\honisuhi
2008-12-22 18:05 . 2008-12-22 18:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\hebowugi
2008-12-22 18:05 . 2008-12-22 18:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\fowerovo
2008-12-22 18:05 . 2008-12-22 18:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\deyebosi
2008-12-22 18:01 . 2008-12-22 18:01 <DIR> d-------- C:\Downloads
2008-12-13 10:47 . 2008-12-13 10:47 <DIR> d-------- c:\program files\Red Kawa
2008-12-13 10:46 . 2008-12-13 10:46 <DIR> d-------- C:\OpenCandy
2008-12-07 20:59 . 2008-12-07 20:59 552 --a------ c:\windows\system32\d3d8caps.dat
2008-12-07 20:57 . 2008-12-07 20:58 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-12-07 20:57 . 2008-12-07 20:57 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\SystemRequirementsLab
2008-12-07 20:53 . 2008-12-07 20:55 <DIR> d-------- c:\documents and settings\homework\Application Data\SystemRequirementsLab
2008-12-07 17:24 . 2008-12-07 17:46 <DIR> d-------- c:\documents and settings\homework\Application Data\Xfire
2008-11-29 09:49 . 2008-11-29 10:18 <DIR> d-------- c:\documents and settings\Waiming Li\dwhelper
2008-11-29 09:30 . 2008-12-22 18:08 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\BitTorrent
2008-11-27 10:50 . 2008-11-27 10:50 <DIR> d-------- C:\My DVD
2008-11-27 09:25 . 2008-11-27 09:25 <DIR> d-------- c:\program files\iPod
2008-11-27 09:25 . 2008-11-27 09:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-27 09:20 . 2008-11-27 09:21 <DIR> d-------- c:\program files\QuickTime
2008-11-26 22:40 . 2008-11-26 22:40 <DIR> d-------- C:\American Gangst
2008-11-26 21:00 . 2008-11-26 21:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\vsosdk
2008-11-26 20:31 . 2008-11-26 20:31 <DIR> d-------- c:\program files\VSO
2008-11-26 20:31 . 2004-05-04 12:53 1,645,320 --a------ c:\windows\gdiplus.dll
2008-11-26 20:31 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2008-11-26 20:31 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2008-11-26 20:31 . 2006-09-29 13:24 217,127 --a------ c:\windows\system32\drv43260.dll
2008-11-26 20:31 . 2006-09-29 13:25 208,935 --a------ c:\windows\system32\drv33260.dll
2008-11-26 20:31 . 2006-09-29 13:26 176,165 --a------ c:\windows\system32\drv23260.dll
2008-11-26 20:31 . 2007-03-18 21:37 65,602 --a------ c:\windows\system32\cook3260.dll
2008-11-26 18:31 . 2008-12-02 19:07 <DIR> d-------- c:\documents and settings\homework\Application Data\Vso
2008-11-26 17:53 . 2008-11-26 17:54 <DIR> d-------- c:\program files\WinAVI Video Capture
2008-11-26 17:47 . 2008-11-27 14:19 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\Vso
2008-11-26 17:47 . 2008-11-26 20:31 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2008-11-26 17:47 . 2008-11-26 20:31 47,360 --a------ c:\documents and settings\Waiming Li\Application Data\pcouffin.sys
2008-11-26 16:39 . 2006-11-01 14:52 765,952 --a------ c:\windows\system32\xvidcore.dll
2008-11-26 16:39 . 2006-11-01 14:54 180,224 --a------ c:\windows\system32\xvidvfw.dll
2008-11-26 12:41 . 2008-11-26 12:41 <DIR> d-------- c:\documents and settings\homework\Application Data\AVS4YOU

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 13:22 --------- d-----w c:\documents and settings\Waiming Li\Application Data\OpenOffice.org2
2008-12-26 03:09 --------- d-----w c:\documents and settings\homework\Application Data\DNA
2008-12-26 00:47 --------- d-----w c:\documents and settings\homework\Application Data\OpenOffice.org2
2008-12-26 00:46 --------- d-----w c:\program files\Steam
2008-12-23 23:36 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-23 23:14 --------- d-----w c:\program files\MSN Messenger
2008-12-22 23:07 --------- d-----w c:\documents and settings\homework\Application Data\BitTorrent
2008-12-13 15:55 --------- d-----w c:\documents and settings\Waiming Li\Application Data\Apple Computer
2008-12-13 14:38 --------- d-----w c:\documents and settings\Waiming Li\Application Data\DiskAid
2008-11-27 14:26 --------- d-----w c:\program files\iTunes
2008-11-27 14:25 --------- d-----w c:\program files\Common Files\Apple
2008-11-26 01:49 --------- d-----w c:\program files\AviSynth 2.5
2008-11-26 01:31 --------- d-----w c:\documents and settings\Waiming Li\Application Data\AVS4YOU
2008-11-26 01:31 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-11-26 01:30 --------- d-----w c:\program files\Common Files\AVSMedia
2008-11-26 01:30 --------- d-----w c:\program files\AVS4YOU
2008-11-25 01:19 --------- d-----w c:\program files\G-steam
2008-11-20 20:33 30 ----a-w c:\documents and settings\Waiming Li\jagex_runescape_preferences.dat
2008-11-19 22:26 --------- d-----w c:\program files\Seekeen
2008-11-19 22:17 --------- d-----w c:\documents and settings\homework\Application Data\DiskAid
2008-11-18 23:22 --------- d-----w c:\program files\7-Zip
2008-11-18 22:52 --------- d-----w c:\documents and settings\homework\Application Data\Corel
2008-11-18 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\Winferno
2008-11-18 22:46 --------- d-----w c:\documents and settings\Waiming Li\Application Data\WeatherBug
2008-11-18 22:45 --------- d-----w c:\program files\Free Offers from Freeze.com
2008-11-13 02:01 --------- d-----w c:\documents and settings\Waiming Li\Application Data\Corel
2008-11-07 20:20 --------- d-----w c:\program files\DigiDNA
2008-11-06 03:01 --------- d-----w c:\program files\WinSCP
2008-11-03 21:34 --------- d-----w c:\program files\iPhoneBrowser
2008-10-29 11:01 --------- d-----w c:\documents and settings\homework\Application Data\LimeWire
2008-10-29 06:09 --------- d-----w c:\program files\HostEx32
2008-10-29 06:08 --------- d-----w c:\program files\Hide Window Hotkey
2008-10-29 06:06 --------- d-----w c:\program files\Common Files\AOL
2008-10-29 06:06 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-10-27 19:37 --------- d-----w c:\documents and settings\homework\Application Data\Ventrilo
2008-10-26 16:28 --------- d-----w c:\program files\Quick Hide Windows
2008-10-26 16:23 --------- d-----w c:\program files\Taskbar Hide
2008-10-15 21:50 11,830 ----a-w c:\documents and settings\ipod-converter\unins000.dat
2008-10-15 21:49 668,938 ----a-w c:\documents and settings\ipod-converter\unins000.exe
2008-09-13 13:42 22,328 ----a-w c:\documents and settings\homework\Application Data\PnkBstrK.sys
2008-04-21 13:15 2,105,344 ----a-w c:\documents and settings\ipod-converter\MP4Converter.exe
2008-04-21 13:14 1,875,968 ----a-w c:\documents and settings\ipod-converter\DVD2X.exe
2008-02-27 13:39 167,936 ----a-w c:\documents and settings\ipod-converter\EncoderCore.dll
2008-02-27 13:37 3,787,302 ----a-w c:\documents and settings\ipod-converter\avcodec.dll
2008-02-25 15:19 1,143,989 ----a-w c:\documents and settings\ipod-converter\avformat.dll
2007-12-14 02:16 417,792 ----a-w c:\documents and settings\ipod-converter\BurnerCore.dll
2007-12-09 19:27 172,032 ----a-w c:\documents and settings\ipod-converter\VideoPropertiesControler.dll
2007-07-02 19:00 245,760 ----a-w c:\documents and settings\ipod-converter\InputX.exe
2007-04-08 14:00 45,146 ----a-w c:\documents and settings\ipod-converter\DataExt.dll
2006-11-12 15:05 765,952 ----a-w c:\documents and settings\ipod-converter\MP4ConverterSuite.exe
2006-11-12 00:22 0 ----a-w c:\documents and settings\Waiming Li\Application Data\wklnhst.dat
2006-07-04 14:11 819,200 ----a-w c:\documents and settings\ipod-converter\xvidcore.dll
2006-01-19 20:32 36,864 ----a-w c:\documents and settings\ipod-converter\UpdateDetector.exe
2005-08-24 19:28 119,296 ----a-w c:\documents and settings\ipod-converter\WnASPI32.dll
2005-01-27 20:48 28,672 ----a-w c:\documents and settings\ipod-converter\CheckOSVersion.exe
2003-06-19 16:05 1,015,859 ----a-w c:\documents and settings\ipod-converter\mfc42.dll
2003-03-17 17:38 60,416 ----a-w c:\documents and settings\ipod-converter\dsetup.dll
2002-08-29 07:41 323,072 ----a-w c:\documents and settings\ipod-converter\msvcrt.dll
2002-05-24 00:40 110,080 ----a-w c:\documents and settings\ipod-converter\nLame.dll
2008-09-22 23:00 63,628 --sha-w c:\windows\system32\nonowoda.dll
2008-09-22 23:00 63,628 --sha-w c:\windows\system32\puwareda.dll
2008-09-22 23:00 63,628 --sha-w c:\windows\system32\sofokujo.dll
2008-09-23 19:50 4,096 --sha-w c:\windows\system32\tipiyipo.dll
2008-09-06 04:24 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090620080907\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f74ce407-9cfc-4ce5-8c82-4ad1bbcccaf6}]
2008-09-25 11:58 62464 --------- c:\windows\system32\tepepife.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-07-16 389120]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"RegistryMechanic"="c:\program files\MSN Messenger\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"yotiyumobu"="c:\windows\system32\mesekaho.dll" [BU]
"CPM93bf67fb"="c:\windows\system32\moheligo.dll" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

c:\documents and settings\Waiming Li\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 393216]

c:\documents and settings\homework\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-07 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqppMgg]
ssqppMgg.dll [BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre1.5.0_11\\bin\\java.exe"=
"c:\\Program Files\\Java\\jdk1.5.0_11\\bin\\java.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\homework\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\OpenOffice.org 2.1\\program\\soffice.bin"=
"c:\\ComboFix\\fdsv.cfexe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14915:TCP"= 14915:TCP:BitComet 14915 TCP
"14915:UDP"= 14915:UDP:BitComet 14915 UDP

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2007-01-15 58464]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
S3 TPyqEqCUs;TPyqEqCUs;\??\c:\documents and settings\All Users\Documents\My Pictures\Everything u need\mhs\XELQFBP []
S3 XDva158;XDva158;\??\c:\windows\system32\XDva158.sys []
S3 XDva164;XDva164;\??\c:\windows\system32\XDva164.sys []
S3 XDva165;XDva165;\??\c:\windows\system32\XDva165.sys []
S3 XDva167;XDva167;\??\c:\windows\system32\XDva167.sys []
S3 XDva177;XDva177;\??\c:\windows\system32\XDva177.sys []
S3 XDva186;XDva186;\??\c:\windows\system32\XDva186.sys []
S3 XDva189;XDva189;\??\c:\windows\system32\XDva189.sys []
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys []
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys []
S3 XDva201;XDva201;\??\c:\windows\system32\XDva201.sys []
S3 XDva212;XDva212;\??\c:\windows\system32\XDva212.sys []
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys []
S3 XDva219;XDva219;\??\c:\windows\system32\XDva219.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-12-26 c:\windows\Tasks\evxqynnv.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-12-26 c:\windows\Tasks\kbggxlow.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2008-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-12-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]

2008-12-26 c:\windows\Tasks\uwpoizuz.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]
.
- - - - ORPHANS REMOVED - - - -

BHO-{B4BC1A65-FC1A-41E9-80CA-A6C4EC96943D} - (no file)
SSODL-SSODL-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)

.
------- Supplementary Scan -------
.
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Waiming Li\Application Data\Mozilla\Firefox\Profiles\qdpmy5ps.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 08:37:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\TEMP\TMP0000000C9BCAB9730C5E216B 524288 bytes executable

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TPyqEqCUs]
"ImagePath"="\??\c:\documents and settings\All Users\Documents\My Pictures\Everything u need\mhs\XELQFBP"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(696)
c:\windows\system32\EntApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Network Associates\Common Framework\FrameworkService.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\combofix\hidec.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files\Network Associates\VirusScan\mcshield.exe
c:\program files\Network Associates\VirusScan\vstskmgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\imapi.exe
c:\program files\iPod\bin\iPodService.exe
c:\combofix\Catchme.tmp
.
**************************************************************************
.
Completion time: 2008-12-26 8:44:02 - machine was rebooted [Waiming Li]
ComboFix-quarantined-files.txt 2008-12-26 13:42:42

Pre-Run: 38,628,319,232 bytes free
Post-Run: 38,562,566,144 bytes free

308 --- E O F --- 2008-12-22 20:03:48

This is the hijack log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:45:25 AM, on 12/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\ComboFix\hidec.exe
C:\WINDOWS\system32\cmd.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\ComboFix\Catchme.tmp
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - (no file)
O2 - BHO: (no name) - {f74ce407-9cfc-4ce5-8c82-4ad1bbcccaf6} - C:\WINDOWS\system32\tepepife.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s
O4 - HKLM\..\Run: [CPM93bf67fb] Rundll32.exe "c:\windows\system32\moheligo.dll",a
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\MSN Messenger\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164093190093
O20 - Winlogon Notify: ssqppMgg - ssqppMgg.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 9145 bytes

peku006 · Dec 26, 2008

Hi alex76

1 - Disable Spybot Teatimer temporarily

Right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
Click on Mode > Advanced Mode. When it prompts you, click Yes.
On the left hand side, click on Tools.
Check (tick) this box if it is not yet ticked: Resident.
You will notice that Resident is now added under Tools. Click on Resident.
Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
Exit Spybot Search & Destroy.

Download ResetTeaTimer.bat.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

Restart your computer for the changes to take effect

2 - Remove bad HijackThis entries

Run HijackThis
Click on the Scan button
Put a check beside all of the items listed below (if present):
- O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
  O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file)
  O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - (no file)
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - (no file)
  O2 - BHO: (no name) - {f74ce407-9cfc-4ce5-8c82-4ad1bbcccaf6} - C:\WINDOWS\system32\tepepife.dll
  O4 - HKLM\..\Run: [yotiyumobu] Rundll32.exe "C:\WINDOWS\system32\mesekaho.dll",s
  O4 - HKLM\..\Run: [CPM93bf67fb] Rundll32.exe "c:\windows\system32\moheligo.dll",a
  O20 - Winlogon Notify: ssqppMgg - ssqppMgg.dll (file missing)
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.

3 - Run CFScript

Open Notepad and copy/paste the text in the box into the window:

Code:

File::
c:\windows\system32\nonowoda.dll
c:\windows\system32\puwareda.dll
c:\windows\system32\sofokujo.dll
c:\windows\system32\tipiyipo.dll
c:\windows\system32\tepepife.dll
c:\windows\system32\mesekaho.dll
c:\windows\system32\moheligo.dll
c:\windows\system32\ssqppMgg.dll
c:\windows\Tasks\evxqynnv.job
c:\windows\Tasks\kbggxlow.job
c:\windows\Tasks\uwpoizuz.job

Folder::
c:\documents and settings\All Users\Application Data\mezinoma
c:\documents and settings\All Users\Application Data\ladilasa
c:\documents and settings\All Users\Application Data\honisuhi
c:\documents and settings\All Users\Application Data\hebowugi
c:\documents and settings\All Users\Application Data\fowerovo
c:\documents and settings\All Users\Application Data\deyebosi

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

4 - Malwarebytes' Anti-Malware

Open Malwarebytes' Anti-Malware
Select the Update tab
Click Check for Updates
After the update have been completed, Select the Scanner tab.
Select Perform full scan, then click on Scan
Leave the default options as it is and click on Start Scan
When done, you will be prompted. Click OK, then click on Show Results
Checked (ticked) all items and click on Remove Selected
After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

5 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

6 - Status Check
Please reply with

1. the ComboFix log(C:\ComboFix.txt)
2. the Malwarebytes' Anti-Malware Log
3. a fresh HijackThis log
How is the computer running now?

Thanks peku006

alex76 · Dec 26, 2008

Spybot search and destroy is not in my the system tray as of now and i dont know how to get it back in there

peku006 · Dec 26, 2008

Hi alex76

OK don't worry about Teatimer, continue to Step 2 (Remove bad HijackThis entries)

alex76 · Dec 26, 2008

For some reason i couldn't get on the website until now. Here are the logs

Combofix
ComboFix 08-12-26.01 - Waiming Li 2008-12-26 11:20:23.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1428 [GMT -5:00]
Running from: c:\documents and settings\Waiming Li\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Waiming Li\Desktop\CFScript.txt
FW: McAfee Personal Firewall *enabled*
* Created a new restore point
* Resident AV is active

FILE ::
c:\windows\system32\mesekaho.dll
c:\windows\system32\moheligo.dll
c:\windows\system32\nonowoda.dll
c:\windows\system32\puwareda.dll
c:\windows\system32\sofokujo.dll
c:\windows\system32\ssqppMgg.dll
c:\windows\system32\tepepife.dll
c:\windows\system32\tipiyipo.dll
c:\windows\Tasks\evxqynnv.job
c:\windows\Tasks\kbggxlow.job
c:\windows\Tasks\uwpoizuz.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\deyebosi
c:\documents and settings\All Users\Application Data\deyebosi\deyebosi.dll
c:\documents and settings\All Users\Application Data\fowerovo
c:\documents and settings\All Users\Application Data\hebowugi
c:\documents and settings\All Users\Application Data\honisuhi
c:\documents and settings\All Users\Application Data\ladilasa
c:\documents and settings\All Users\Application Data\ladilasa\asalidal.ini
c:\documents and settings\All Users\Application Data\mezinoma
c:\documents and settings\All Users\Application Data\mezinoma\mezinoma.dll.tmp
c:\windows\system32\nonowoda.dll
c:\windows\system32\pidokofu.dll
c:\windows\system32\puwareda.dll
c:\windows\system32\sofokujo.dll
c:\windows\system32\tepepife.dll
c:\windows\system32\tikiyabu.dll
c:\windows\system32\tipiyipo.dll
c:\windows\system32\ubayikit.ini
c:\windows\Tasks\evxqynnv.job
c:\windows\Tasks\kbggxlow.job
c:\windows\Tasks\uwpoizuz.job

.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.

2008-12-25 18:01 . 2008-12-25 18:01 <DIR> d-------- c:\program files\Trend Micro
2008-12-25 17:29 . 2008-12-25 17:29 <DIR> d-------- c:\documents and settings\homework\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-25 09:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-25 09:02 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-25 09:02 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-22 18:01 . 2008-12-22 18:01 <DIR> d-------- C:\Downloads
2008-12-13 10:47 . 2008-12-13 10:47 <DIR> d-------- c:\program files\Red Kawa
2008-12-13 10:46 . 2008-12-13 10:46 <DIR> d-------- C:\OpenCandy
2008-12-07 20:59 . 2008-12-07 20:59 552 --a------ c:\windows\system32\d3d8caps.dat
2008-12-07 20:57 . 2008-12-07 20:58 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-12-07 20:57 . 2008-12-07 20:57 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\SystemRequirementsLab
2008-12-07 20:53 . 2008-12-07 20:55 <DIR> d-------- c:\documents and settings\homework\Application Data\SystemRequirementsLab
2008-12-07 17:24 . 2008-12-07 17:46 <DIR> d-------- c:\documents and settings\homework\Application Data\Xfire
2008-11-29 09:49 . 2008-11-29 10:18 <DIR> d-------- c:\documents and settings\Waiming Li\dwhelper
2008-11-27 10:50 . 2008-11-27 10:50 <DIR> d-------- C:\My DVD
2008-11-27 09:25 . 2008-11-27 09:25 <DIR> d-------- c:\program files\iPod
2008-11-27 09:25 . 2008-11-27 09:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-27 09:20 . 2008-11-27 09:21 <DIR> d-------- c:\program files\QuickTime
2008-11-26 22:40 . 2008-11-26 22:40 <DIR> d-------- C:\American Gangst
2008-11-26 21:00 . 2008-11-26 21:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\vsosdk
2008-11-26 20:31 . 2008-11-26 20:31 <DIR> d-------- c:\program files\VSO
2008-11-26 20:31 . 2004-05-04 12:53 1,645,320 --a------ c:\windows\gdiplus.dll
2008-11-26 20:31 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2008-11-26 20:31 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2008-11-26 20:31 . 2006-09-29 13:24 217,127 --a------ c:\windows\system32\drv43260.dll
2008-11-26 20:31 . 2006-09-29 13:25 208,935 --a------ c:\windows\system32\drv33260.dll
2008-11-26 20:31 . 2006-09-29 13:26 176,165 --a------ c:\windows\system32\drv23260.dll
2008-11-26 20:31 . 2007-03-18 21:37 65,602 --a------ c:\windows\system32\cook3260.dll
2008-11-26 18:31 . 2008-12-02 19:07 <DIR> d-------- c:\documents and settings\homework\Application Data\Vso
2008-11-26 17:53 . 2008-11-26 17:54 <DIR> d-------- c:\program files\WinAVI Video Capture
2008-11-26 17:47 . 2008-11-27 14:19 <DIR> d-------- c:\documents and settings\Waiming Li\Application Data\Vso
2008-11-26 17:47 . 2008-11-26 20:31 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2008-11-26 17:47 . 2008-11-26 20:31 47,360 --a------ c:\documents and settings\Waiming Li\Application Data\pcouffin.sys
2008-11-26 16:39 . 2006-11-01 14:52 765,952 --a------ c:\windows\system32\xvidcore.dll
2008-11-26 16:39 . 2006-11-01 14:54 180,224 --a------ c:\windows\system32\xvidvfw.dll
2008-11-26 12:41 . 2008-11-26 12:41 <DIR> d-------- c:\documents and settings\homework\Application Data\AVS4YOU

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 16:00 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-26 15:55 --------- d-----w c:\documents and settings\Waiming Li\Application Data\OpenOffice.org2
2008-12-26 03:09 --------- d-----w c:\documents and settings\homework\Application Data\DNA
2008-12-26 00:47 --------- d-----w c:\documents and settings\homework\Application Data\OpenOffice.org2
2008-12-26 00:46 --------- d-----w c:\program files\Steam
2008-12-23 23:36 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-23 23:14 --------- d-----w c:\program files\MSN Messenger
2008-12-22 23:07 --------- d-----w c:\documents and settings\homework\Application Data\BitTorrent
2008-12-13 15:55 --------- d-----w c:\documents and settings\Waiming Li\Application Data\Apple Computer
2008-12-13 14:38 --------- d-----w c:\documents and settings\Waiming Li\Application Data\DiskAid
2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-10 01:43 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys
2008-11-27 14:26 --------- d-----w c:\program files\iTunes
2008-11-27 14:25 --------- d-----w c:\program files\Common Files\Apple
2008-11-26 01:49 --------- d-----w c:\program files\AviSynth 2.5
2008-11-26 01:31 --------- d-----w c:\documents and settings\Waiming Li\Application Data\AVS4YOU
2008-11-26 01:31 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-11-26 01:30 --------- d-----w c:\program files\Common Files\AVSMedia
2008-11-26 01:30 --------- d-----w c:\program files\AVS4YOU
2008-11-25 01:19 --------- d-----w c:\program files\G-steam
2008-11-20 20:33 30 ----a-w c:\documents and settings\Waiming Li\jagex_runescape_preferences.dat
2008-11-19 22:26 --------- d-----w c:\program files\Seekeen
2008-11-19 22:17 --------- d-----w c:\documents and settings\homework\Application Data\DiskAid
2008-11-18 23:22 --------- d-----w c:\program files\7-Zip
2008-11-18 22:52 --------- d-----w c:\documents and settings\homework\Application Data\Corel
2008-11-18 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\Winferno
2008-11-18 22:46 --------- d-----w c:\documents and settings\Waiming Li\Application Data\WeatherBug
2008-11-18 22:45 --------- d-----w c:\program files\Free Offers from Freeze.com
2008-11-18 21:50 1,700,352 ----a-w c:\windows\system32\gdiplus.dll
2008-11-13 02:01 --------- d-----w c:\documents and settings\Waiming Li\Application Data\Corel
2008-11-07 20:20 --------- d-----w c:\program files\DigiDNA
2008-11-06 03:01 --------- d-----w c:\program files\WinSCP
2008-11-03 21:34 --------- d-----w c:\program files\iPhoneBrowser
2008-10-29 11:01 --------- d-----w c:\documents and settings\homework\Application Data\LimeWire
2008-10-29 06:09 --------- d-----w c:\program files\HostEx32
2008-10-29 06:08 --------- d-----w c:\program files\Hide Window Hotkey
2008-10-29 06:06 --------- d-----w c:\program files\Common Files\AOL
2008-10-29 06:06 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-10-27 19:37 --------- d-----w c:\documents and settings\homework\Application Data\Ventrilo
2008-10-26 16:28 --------- d-----w c:\program files\Quick Hide Windows
2008-10-26 16:23 --------- d-----w c:\program files\Taskbar Hide
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 13:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:11 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 21:50 11,830 ----a-w c:\documents and settings\ipod-converter\unins000.dat
2008-10-15 21:49 668,938 ----a-w c:\documents and settings\ipod-converter\unins000.exe
2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06 633,632 ----a-w c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:02 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-13 13:42 22,328 ----a-w c:\documents and settings\homework\Application Data\PnkBstrK.sys
2008-04-21 13:15 2,105,344 ----a-w c:\documents and settings\ipod-converter\MP4Converter.exe
2008-04-21 13:14 1,875,968 ----a-w c:\documents and settings\ipod-converter\DVD2X.exe
2008-02-27 13:39 167,936 ----a-w c:\documents and settings\ipod-converter\EncoderCore.dll
2008-02-27 13:37 3,787,302 ----a-w c:\documents and settings\ipod-converter\avcodec.dll
2008-02-25 15:19 1,143,989 ----a-w c:\documents and settings\ipod-converter\avformat.dll
2007-12-14 02:16 417,792 ----a-w c:\documents and settings\ipod-converter\BurnerCore.dll
2007-12-09 19:27 172,032 ----a-w c:\documents and settings\ipod-converter\VideoPropertiesControler.dll
2007-07-02 19:00 245,760 ----a-w c:\documents and settings\ipod-converter\InputX.exe
2007-04-08 14:00 45,146 ----a-w c:\documents and settings\ipod-converter\DataExt.dll
2006-11-12 15:05 765,952 ----a-w c:\documents and settings\ipod-converter\MP4ConverterSuite.exe
2006-11-12 00:22 0 ----a-w c:\documents and settings\Waiming Li\Application Data\wklnhst.dat
2006-07-04 14:11 819,200 ----a-w c:\documents and settings\ipod-converter\xvidcore.dll
2006-01-19 20:32 36,864 ----a-w c:\documents and settings\ipod-converter\UpdateDetector.exe
2005-08-24 19:28 119,296 ----a-w c:\documents and settings\ipod-converter\WnASPI32.dll
2005-01-27 20:48 28,672 ----a-w c:\documents and settings\ipod-converter\CheckOSVersion.exe
2003-06-19 16:05 1,015,859 ----a-w c:\documents and settings\ipod-converter\mfc42.dll
2003-03-17 17:38 60,416 ----a-w c:\documents and settings\ipod-converter\dsetup.dll
2002-08-29 07:41 323,072 ----a-w c:\documents and settings\ipod-converter\msvcrt.dll
2002-05-24 00:40 110,080 ----a-w c:\documents and settings\ipod-converter\nLame.dll
2008-09-06 04:24 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090620080907\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-07-16 389120]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-03 68856]
"RegistryMechanic"="c:\program files\MSN Messenger\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

c:\documents and settings\Waiming Li\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 393216]

c:\documents and settings\homework\Start Menu\Programs\Startup\
OpenOffice.org 2.1.lnk - c:\program files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-07 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\yuhisona.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre1.5.0_11\\bin\\java.exe"=
"c:\\Program Files\\Java\\jdk1.5.0_11\\bin\\java.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\homework\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\OpenOffice.org 2.1\\program\\soffice.bin"=
"c:\\ComboFix\\fdsv.cfexe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\Program Files\\Creative\\Sync Manager Unicode\\CTSyncU.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14915:TCP"= 14915:TCP:BitComet 14915 TCP
"14915:UDP"= 14915:UDP:BitComet 14915 UDP

R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2007-01-15 58464]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
S3 TPyqEqCUs;TPyqEqCUs;\??\c:\documents and settings\All Users\Documents\My Pictures\Everything u need\mhs\XELQFBP []
S3 XDva158;XDva158;\??\c:\windows\system32\XDva158.sys []
S3 XDva164;XDva164;\??\c:\windows\system32\XDva164.sys []
S3 XDva165;XDva165;\??\c:\windows\system32\XDva165.sys []
S3 XDva167;XDva167;\??\c:\windows\system32\XDva167.sys []
S3 XDva177;XDva177;\??\c:\windows\system32\XDva177.sys []
S3 XDva186;XDva186;\??\c:\windows\system32\XDva186.sys []
S3 XDva189;XDva189;\??\c:\windows\system32\XDva189.sys []
S3 XDva190;XDva190;\??\c:\windows\system32\XDva190.sys []
S3 XDva195;XDva195;\??\c:\windows\system32\XDva195.sys []
S3 XDva201;XDva201;\??\c:\windows\system32\XDva201.sys []
S3 XDva212;XDva212;\??\c:\windows\system32\XDva212.sys []
S3 XDva215;XDva215;\??\c:\windows\system32\XDva215.sys []
S3 XDva219;XDva219;\??\c:\windows\system32\XDva219.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-12-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

BHO-{f74ce407-9cfc-4ce5-8c82-4ad1bbcccaf6} - c:\windows\system32\tepepife.dll

.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Waiming Li\Application Data\Mozilla\Firefox\Profiles\qdpmy5ps.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 11:23:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TPyqEqCUs]
"ImagePath"="\??\c:\documents and settings\All Users\Documents\My Pictures\Everything u need\mhs\XELQFBP"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(700)
c:\windows\system32\EntApi.dll

- - - - - - - > 'explorer.exe'(1972)
c:\windows\system32\EntApi.dll
.
Completion time: 2008-12-26 11:27:03
ComboFix-quarantined-files.txt 2008-12-26 16:26:29
ComboFix2.txt 2008-12-26 13:44:03

Pre-Run: 41,833,811,968 bytes free
Post-Run: 41,815,523,328 bytes free

307 --- E O F --- 2008-12-22 20:03:48

Malwarebytes

Malwarebytes' Anti-Malware 1.31
Database version: 1550
Windows 5.1.2600 Service Pack 3

12/26/2008 1:32:16 PM
mbam-log-2008-12-26 (13-32-16).txt

Scan type: Full Scan (C:\|)
Objects scanned: 308739
Time elapsed: 2 hour(s), 2 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\fowoluye.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\moheligo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pidokofu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tikiyabu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP418\A0183874.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP418\A0183875.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP421\A0184169.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP421\A0184170.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:32:48 PM, on 12/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\MSN Messenger\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164093190093
O20 - AppInit_DLLs: C:\WINDOWS\system32\yuhisona.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 8221 bytes

peku006 · Dec 27, 2008

Hi alex76

1 - Download and run OTMoveIt3

Download OTMoveIt3 by OldTimer from here and save it to your desktop
Launch OTMoveIt3.exe and copy the text from the codebox below into the lefthand box below "Paste Instructions for Items to be Moved"
Code:
```
:files
WINDOWS\system32\yuhisona.dll

:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
```
Double-check that the input matches the code box above and then click the MoveIt! button to start the script. If you're prompted about rebooting allow the request.
Once OTMoveIt finishes, a log will be located at C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss. (mmddyyyy_hhmmss is a timestamp from when the log was created)
Include this log in your next reply

2 - Update Java and Remove Old Versions

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.

Then download and install Java SE Runtime Environment (JRE) 6 Update 10 following the instructions below:

Go to Java SE Runtime Environment (JRE) 6 Update 11 and click on Download button.
In Platform box choose Windows.
Check the box to Accept License Agreement and click Continue.
Click on Windows Offline Installation, click on the link under it which says "jre-6u10-windows-i586-p.exe" and save the downloaded file to your desktop.
Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
Reboot your computer

3 - Clean temp files

Download and Run ATF Cleaner
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.Double-click ATF Cleaner.exe to open it.

Under Main choose:
- Windows Temp
  Current User Temp
  All Users Temp
  Temporary Internet Files
  Prefetch
  Java Cache
  *The other boxes are optional*
  Then click the Empty Selected button.
if you use Firefox:
- Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
if you use Opera:
- Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program

4 - Kaspersky Online Scan

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

5 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

6 - Status Check
Please reply with

1. the OTMoveIt3 log
2. the Kaspersky online scanner report
3. a fresh HijackThis log

Thanks peku006

alex76 · Dec 29, 2008

Sorry for the late reply peku, i was only able to get the otmove it log and the hjt log. The online scanner would takes 6 hr and in the end would not be completed

hjt log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03:36 PM, on 12/28/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061107
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\MSN Messenger\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164093190093
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 8877 bytes

move it log
========== FILES ==========
File/Folder WINDOWS\system32\yuhisona.dll not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\\AppInit_DLLs deleted successfully.

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12272008_081006

peku006 · Dec 29, 2008

Hi alex76
Let´s try this........

Please go to F-Secure website to perform an online scan. Click on Start scanning at the bottom of the page.
You may be prompted to install an ActiveX before you are able to accept the License Agreement. If prompted, please install it. After installing, the Accept button will be available.
Click on Accept to accept the License Agreement.
Click on Custom Scan.
- Under Virus Scan Options, select the Scan whole system option.
- Under Other Scan Options, select these options:
  - Scan all files
  - Scan whole system for rootkits
  - Scan whole system for spyware
  - Scan inside archives
  - Use advanced heuristics
Click Start.
It will start installing the scanner and virus definitions. Once the installation is done, it will start scanning automatically. This takes a while. Please be patient.
Click on I want decide item by item.
Under Actions, select None for all infections found.
Click Next.
Click on Show Report.
Please copy and paste this report in your next reply.
Click Finish.

Thanks peku006

alex76 · Dec 31, 2008

here is the log

Scanning Report
Tuesday, December 30, 2008 16:48:50 - 19:56:52

Computer name: LI-1
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\
Result: 8 malware found
TrackingCookie.Atdmt (spyware)

* System

TrackingCookie.Doubleclick (spyware)

* System

TrackingCookie.Webtrends (spyware)

* System

Vundo.FBW (virus)

* C:\Qoobox\Quarantine\C\WINDOWS\system32\edifetus.ini.vir (Submitted)
* C:\Qoobox\Quarantine\C\WINDOWS\system32\eyulowof.ini.vir (Submitted)
* C:\Qoobox\Quarantine\C\WINDOWS\system32\ubayikit.ini.vir (Submitted)
* C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\ladilasa\asalidal.ini.vir (Submitted)

W32/Horst.gen33 (virus)

* C:\Program Files\E-Zsoft\iPodVideoConverter\install.dll (Submitted)

Statistics
Scanned:

* Files: 433372
* System: 3630
* Not scanned: 170

Actions:

* Disinfected: 0
* Renamed: 0
* Deleted: 0
* None: 9
* Submitted: 5

Files not scanned:

* 8sxOOT.INI C:\HIBERFIL.SYS
* C:\NTDETECT.COM
* C:\NTLDR
* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\1EBE968EB7AF815A32641E6185350A9E.MOF
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\4F48C068258C204EBDA35D6DEA89BDC8.MOF
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\7F417E1A6D819A9B2FEB55DA6858EA0A.MOF
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\8858F1BA0D460E5A5B27AB13DE3ACB5D.MOF
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\8A94AF24F162D580E3D9889344A3A317.MOF
* C:\WINDOWS\SYSTEM32\WBEM\AUTORECOVER\903E49C444C46FEF5F2C3A189C9CEF71.MOF
* C:\WINDOWS\SYSTEM32\CONFIG\ACEEVENT.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\APPEVENT.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.BAK
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.TMP.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\INTERNET.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\MEDIA CE.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SAM.BAK
* C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SAM.TMP.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SECEVENT.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.BAK
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.TMP.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.BAK
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.TMP.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SYSEVENT.EVT
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.BAK
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.TMP.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\TEMPKEY.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\USERDIFF
* C:\WINDOWS\SYSTEM32\CONFIG\USERDIFF.LOG
* C:\WINDOWS\REPAIR\AUTOEXEC.NT
* C:\WINDOWS\REPAIR\CONFIG.NT
* C:\WINDOWS\REPAIR\DEFAULT
* C:\WINDOWS\REPAIR\DS_SAM
* C:\WINDOWS\REPAIR\DS_SECURITY
* C:\WINDOWS\REPAIR\DS_SOFTWARE
* C:\WINDOWS\REPAIR\NTUSER.DAT
* C:\WINDOWS\REPAIR\SAM
* C:\WINDOWS\REPAIR\SECSETUP.INF
* C:\WINDOWS\REPAIR\SECURITY
* C:\WINDOWS\REPAIR\SETUP.LOG
* C:\WINDOWS\REPAIR\SOFTWARE
* C:\WINDOWS\REPAIR\SYSTEM.BAK
* C:\WINDOWS\MINIDUMP\MINI080808-01.DMP
* C:\WINDOWS\MINIDUMP\MINI080808-02.DMP
* C:\WINDOWS\MINIDUMP\MINI112606-01.DMP
* C:\WINDOWS\DEBUG\USERMODE\USERENV.BAK
* C:\WINDOWS\DEBUG\USERMODE\USERENV.LOG
* C:\PROGRAM FILES\MOZILLA FIREFOX\UNINSTALL\UNINSTALL.UPDATE
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\agntcons.vbs
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\agntlang.vbs
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\comctl.lpk
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\config.ini
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\pbar.vbs
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\UnInsStr.vbs
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\uninst.vbs
* C:\Program Files\McAfee.com\Agent\uninst\screm.ui\uninstall.htm
* C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{E646DCF0-5A68-11D5-B229-002078017FBF}\SETUP.ILG
* C:\PROGRAM FILES\INSTALLSHIELD INSTALLATION INFORMATION\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\SETUP.ILG
* C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBARNOTIFIER\SWG-3.0.1225.9868\SEARCHWITHGOOGLEUPDATE.EXE
* C:\DOCUMENTS AND SETTINGS\HOMEWORK\NTUSER.DAT
* C:\DOCUMENTS AND SETTINGS\HOMEWORK\NTUSER.DAT.LOG
* C:\Documents and Settings\homework\My Documents\7zipfree_8675.exe\resource.0000.pkg\ydetect-browser.exe
* C:\Documents and Seq

Options
Scanning engines:

* F-Secure USS: 2.40.0
* F-Secure Hydra: 2.8.8110, 2008-12-30
* F-Secure AVP: 7.0.171, 2008-12-30
* F-Secure Pegasus: 1.20.0, 2008-11-17
* F-Secure Blacklight: 0.0.0

Scanning options:

* Scan all files
* Scan inside archives
* Use Advanced heuristics

Copyright © 1998-2007 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

peku006 · Dec 31, 2008

Hi alex76

Congratulations, your log looks clean!

Next we remove all used tools.

Double-click OTMoveIt3.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.

Turn ON System Restore

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.6
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install SpyWare Blaster 4.0
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Happy safe surfing! :bigthumb:

alex76 · Dec 31, 2008

Thank you Peku006 for your time and effort for solving my virus problems. I really appreciate it

alex76 · Dec 31, 2008

Sorry for the extra post, but i was looking through Mcafee security center program permissions, and i found 2 suspicous ones. One was Rundll as an app and another one saying Rundll as an app. I have blocked both of them, but one of them keeps unblocking itself.

peku006 · Jan 2, 2009

Hi alex76

Run a dll as an app is a legitimate Microsoft. utility
RunDLL32 is used to run exported functions of a DLL or EXE file.

Malware removal help needed

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

Emeritus- Security Expert

New member

New member

Emeritus- Security Expert