Issues with Computer after virus infection.

[jerobrad]

Hello,

I want to thank you in advance for offering this service - it is genuinely appreciated.

Had a Koobface virus - tried to remedy it (sure that makes you cringe when you read it) still having issues.

Issues: PC will often freeze during initial boot-up; other times it will freeze a few minutes after running applications. IE is redirected but there is no indication where it is going, attempts to troubleshoot that have not been successful.

Running the applications required to provide the attached data was very labor intensive due to constant lockups and related issues. Typically it is impossible to run any sort of diagnostic software in normal mode - safe mode works fine.



Appreciate whatever help you may be able to provide- thanks again!

________


DDS (Version 1.1.0) - NTFSx86 NETWORK
Run by Owner at 15:01:50.67 on Wed 01/07/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.373 [GMT -8:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Outdated)
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Owner\Desktop\dds.scr.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=127.0.0.1:9090
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar3.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: NoExplorer - No File
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [EPSON Stylus C82 Series] c:\windows\system32\spool\drivers\w32x86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /M "Stylus C82" /EF "HKCU"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [EPSON Stylus CX5000 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibva.exe /fu "c:\windows\temp\E_S9E.tmp" /EF "HKLM"
mRun: [EPSON Stylus C82 Series] c:\windows\system32\spool\drivers\w32x86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

S1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2008-12-29 11840]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-17 97928]
S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-12-17 26824]
S3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-12-29 52032]
S3 FileObjInfo;STFileDriver;c:\documents and settings\all users\application data\spyware terminator\fileobjinfo.sys [2008-12-11 5632]
S3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe --> c:\progra~1\mcafee\viruss~1\mcsysmon.exe [?]
S3 oflpydin;oflpydin;\??\c:\docume~1\owner\locals~1\temp\oflpydin.sys --> c:\docume~1\owner\locals~1\temp\oflpydin.sys [?]
S4 89B104B4581B7F50;89B104B4581B7F50;c:\documents and settings\owner\89b104b4581b7f50\89B104B4581B7F50 []
S4 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2008-12-29 68865]
S4 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2008-12-29 151297]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe --> c:\progra~1\avg\avg8\avgwdsvc.exe [?]
S4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-17 76040]
S4 Logical Disk Manager (dmserver) ;Logical Disk Manager (dmserver) ;c:\program files\tinyproxy\tinyproxy.exe --> c:\program files\tinyproxy\tinyproxy.exe [?]
S4 McShield;McAfee Real-time Scanner;c:\program files\mcafee\virusscan\mcshield.exe --> c:\program files\mcafee\virusscan\McShield.exe [?]
S4 Remote Access Connection Manager (RasMan) ;Remote Access Connection Manager (RasMan) ;c:\program files\tinyproxy\tinyproxy.exe --> c:\program files\tinyproxy\tinyproxy.exe [?]

=============== Created Last 30 ================

2009-01-06 15:01 250 a------- c:\windows\gmer.ini
2009-01-06 14:33 <DIR> --d-h--- c:\windows\PIF
2008-12-29 14:44 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avira
2008-12-29 14:44 <DIR> --d----- c:\program files\Avira
2008-12-17 17:43 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2008-12-17 17:43 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2008-12-17 17:35 <DIR> --d----- c:\docume~1\owner\applic~1\AVGTOOLBAR
2008-12-17 17:35 <DIR> --d----- c:\program files\AVG
2008-12-16 14:31 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-15 15:09 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\avg8
2008-12-11 22:20 142,592 a------- c:\windows\system32\drivers\sp_rsdrv2.sys
2008-12-11 22:00 <DIR> --d----- c:\docume~1\owner\applic~1\Spyware Terminator
2008-12-11 22:00 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Spyware Terminator
2008-12-11 22:00 <DIR> --d----- c:\program files\Spyware Terminator
2008-12-11 19:58 <DIR> --d----- c:\windows\pss

==================== Find3M ====================

2008-12-05 16:31 3,512 a------- c:\windows\system32\tmp.reg
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll

============= FINISH: 15:02:55.75 ===============

Guessing this is the remaining Koobface issue:

S4 Remote Access Connection Manager (RasMan) ;Remote Access Connection Manager (RasMan) ;c:\program files\tinyproxy\tinyproxy.exe --> c:\program files\tinyproxy\tinyproxy.exe [?]

^Removed - but issues continue.

J

[amateur]

Hello and welcome to TSF.

Apologies for the delay in response. If you still require assistance, please run a new scan with [bDDS[/b] and post the fresh dds.txt as it has been a while since you posted, and we'll take it from there.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please note that the forum is very busy and if I don’t hear from you in three days this thread will be closed.

[jerobrad]

Thanks - taken care of. Super anti-virus FTW!

JB

[amateur]

Thanks for letting us know.

Surf safely, and Think Prevention!