Problem with computer

Dannyeverett101 · 09-04-2009, 05:21 PM

I had a problem with many viruses it seemed, but recently my computer seems to be working a bit better, but i still think there are viruses in here. I had a problem where the background of my computer came up with the "Your system is infected." message. Sometimes when i would boot up it would go to a black screen with the cursor in the middle, and never fully boot up. I also had a problem where whenever i would try to double-click any program ANYWHERE it would prompt me to pick a program to use to open that program. That problem has seem to have gone away now. I have followed the instructions in the post and here are the logs.

When i download the GMER rootkit scanner it seems that whenever i extract the files to my desktop and try to run the GMER program, the hourglass shows up and then disappears, without running the scan.

Here are the other logs though

DDS:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Danny Everett at 16:13:05.89 on Fri 09/04/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1311 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\drivers\audio\r213367\stacsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\DOCUME~1\DANNYE~1\LOCALS~1\Temp\d.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\mse.exe
C:\DOCUME~1\DANNYE~1\LOCALS~1\Temp\Temporary Directory 1 for gmer (1).zip\gmer.exe
C:\DOCUME~1\DANNYE~1\LOCALS~1\Temp\Temporary Directory 2 for gmer (1).zip\gmer.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\DOCUME~1\DANNYE~1\LOCALS~1\Temp\Temporary Directory 3 for gmer (1).zip\gmer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Danny Everett\My Documents\Downloads\dds (1).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.dell.com
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
mSearchAssistant = hxxp://www.google.com
mWinlogon: Taskman=c:\recycler\s-1-5-21-5648107829-8553251993-109501673-2833\msimfo32.exe
BHO: c:\windows\system32\tajf83ikdmf.dll: {bf56a325-23f2-42ad-f4e4-00aac39caa53} - c:\windows\system32\tajf83ikdmf.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Monopod] c:\docume~1\dannye~1\locals~1\temp\d.exe
uRun: [NordBull] c:\docume~1\dannye~1\locals~1\temp\n.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [SecureUpgrade] "c:\program files\wave systems corp\SecureUpgrade.exe"
mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe"
mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe"
mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [DellConnectionManager] "c:\program files\dell\dell controlpoint\connection manager\Dell.UCM.exe"
mRun: [<NO NAME>]
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [deyisefaza] Rundll32.exe "c:\windows\system32\tijevilu.dll",s
mRun: [Antivirus Pro 2010] "c:\program files\antiviruspro_2010\AntivirusPro_2010.exe" /hide
mRun: [nijajivey] Rundll32.exe "c:\windows\system32\nevorefa.dll",a
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
AppInit_DLLs: cru629.dat c:\windows\system32\juvilisi.dll c:\windows\system32\nevorefa.dll
SSODL: wapiponot - {97281d04-3b53-429c-b813-ec8513903eb6} - c:\windows\system32\nevorefa.dll
STS: c:\windows\system32\tajf83ikdmf.dll: {bf56a325-23f2-42ad-f4e4-00aac39caa53} - c:\windows\system32\tajf83ikdmf.dll
STS: tokatiluy: {97281d04-3b53-429c-b813-ec8513903eb6} - c:\windows\system32\nevorefa.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Authentication Packages = msv1_0 wvauth
LSA: Notification Packages = scecli c:\windows\system32\juvilisi.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dannye~1\applic~1\mozilla\firefox\profiles\4kii7g6s.default\
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

============= SERVICES / DRIVERS ===============

R2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-12-29 320800]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2009-1-22 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2009-1-22 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2009-2-6 443168]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2008-12-4 226640]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2009-3-1 77824]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-6-11 112512]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2009-6-11 32808]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-6-11 239760]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [2009-6-11 232744]
R4 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-9-3 138680]
R4 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys --> c:\windows\system32\drivers\sp_rsdrv2.sys [?]
RUnknown aswFsBlk;aswFsBlk; [x]
RUnknown aswSP;aswSP; [x]
S2 gupdate1ca268228fa8f56;Google Update Service (gupdate1ca268228fa8f56);c:\program files\google\update\GoogleUpdate.exe [2009-8-26 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [2007-4-19 42832]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\drivers\nvtsp50.sys --> c:\windows\system32\drivers\NvtSp50.sys [?]

=============== Created Last 30 ================

2009-09-04 16:11 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-04 16:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-04 16:11 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-09-04 16:11 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-04 08:15 4 a------- c:\windows\system32\bincd32.dat
2009-09-04 08:14 150,016 a------- c:\windows\mse.exe
2009-09-03 22:09 <DIR> --d----- c:\program files\Protection System
2009-09-03 21:44 58 a------- c:\windows\ppp4.dat
2009-09-03 21:44 9 a------- c:\windows\system32\bennuar.old
2009-09-03 21:44 2 a------- c:\windows\ppp3.dat
2009-09-03 21:44 36 a------- c:\windows\system32\sysnet.dat
2009-09-03 21:44 19 a------- c:\windows\system32\sonhelp.htm
2009-09-03 21:43 <DIR> --d----- c:\program files\Windows Police Pro
2009-09-03 21:38 <DIR> --d----- C:\spoolerlogs
2009-09-03 21:33 43 a------- c:\windows\system32\rotscxkrdqpuct.dat
2009-09-03 21:28 150,016 a------- c:\windows\msd.exe
2009-09-03 20:54 150,016 a------- c:\windows\msc.exe
2009-09-03 20:53 150,016 a------- c:\windows\msb.exe
2009-09-03 20:53 664 a------- c:\windows\system32\d3d9caps.dat
2009-09-03 17:47 19,601 a------- c:\windows\yreqozyd.bat
2009-09-03 17:47 16,404 a------- c:\windows\myjile.com
2009-09-03 17:47 15,576 a------- c:\windows\duwymohu.com
2009-09-03 17:47 13,321 a------- c:\windows\hoqiv.db
2009-09-03 17:47 13,287 a------- c:\windows\gehavufav.bin
2009-09-03 17:47 12,423 a------- c:\windows\raqojasyl.lib
2009-09-03 17:47 11,285 a------- c:\windows\axajogy.scr
2009-09-03 17:47 10,204 a------- c:\program files\common files\ehuvuxa.exe
2009-09-03 17:47 19,968 a------- c:\windows\system32\rotscxrdylqjbo.dll
2009-09-03 17:47 43,008 a------- c:\windows\system32\rotscxsdosenbf.dll
2009-09-03 17:47 1,573 a------- c:\windows\system32\rotscxikhwobrb.dat
2009-09-03 17:47 0 a------- c:\windows\system32\AVR09.exe
2009-09-03 17:47 0 a------- c:\windows\system32\winhelper.dll
2009-09-03 17:46 831 a------- c:\windows\system32\critical_warning.html
2009-09-03 17:43 15,000 a------- c:\windows\system32\tajf83ikdmf.dll
2009-09-03 17:30 <DIR> --ds---- c:\documents and settings\danny everett\UserData
2009-09-03 17:23 190,333 a------- c:\windows\system32\wisdstr.exe
2009-09-03 14:32 <DIR> --d----- c:\windows\system32\Service
2009-09-03 13:10 12,454 a------- C:\1517717697
2009-09-03 13:09 103,424 a------- C:\xvhu.exe
2009-09-03 13:09 22,016 a------- C:\emxtqjit.exe
2009-09-03 13:09 49,152 a------- C:\hpbyv.exe
2009-09-03 13:00 <DIR> --d----- c:\windows\system32\PreInstall
2009-09-03 12:38 <DIR> --d----- c:\documents and settings\danny everett\.housecall6.6
2009-09-03 12:30 19,376 a------- c:\program files\common files\gigasomyde.com
2009-09-03 12:30 18,909 a------- c:\windows\utyjivar.vbs
2009-09-03 12:30 17,775 a------- c:\windows\system32\atydug.dl
2009-09-03 12:30 16,704 a------- c:\windows\uvefuzyga.lib
2009-09-03 12:30 16,549 a------- c:\windows\system32\zadisylup.com
2009-09-03 12:30 16,536 a------- c:\windows\ipacimy.inf
2009-09-03 12:30 16,190 a------- c:\windows\yjaryxucy.pif
2009-09-03 12:30 15,142 a------- c:\windows\qulykog.bin
2009-09-03 12:30 14,968 a------- c:\windows\system32\obahoj.db
2009-09-03 12:30 13,757 a------- c:\windows\jilazalil._dl
2009-09-03 12:30 12,195 a------- c:\windows\anufucojyf._sy
2009-09-03 12:30 11,411 a------- c:\docume~1\alluse~1\applic~1\yzebaziwe.bin
2009-09-03 12:30 11,352 a------- c:\docume~1\alluse~1\applic~1\nare.dat
2009-09-03 12:30 10,265 a------- c:\windows\zynol.db
2009-09-03 12:29 <DIR> --d----- c:\program files\AVG
2009-09-03 12:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-09-03 12:27 <DIR> --d----- c:\docume~1\dannye~1\applic~1\AVG8
2009-09-03 11:18 150,528 a------- c:\windows\msa.exe
2009-09-02 17:59 <DIR> --d----- c:\windows\system32\SoftwareDistribution
2009-09-02 12:52 1,904 -------- c:\windows\system32\SetupBD.din
2009-09-02 12:45 <DIR> --d----- c:\docume~1\dannye~1\applic~1\Blitware
2009-09-02 09:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DellUCM
2009-09-01 09:58 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-09-01 09:58 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-09-01 09:58 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-09-01 09:58 1,331,200 a------- c:\windows\system32\CNC330C.DLL
2009-09-01 09:58 274,432 a------- c:\windows\system32\CNC330L.DLL
2009-09-01 09:58 192,512 a------- c:\windows\system32\CNC330O.DLL
2009-09-01 09:58 98,304 a------- c:\windows\system32\CNC330I.DLL
2009-09-01 09:58 15,872 a------- c:\windows\system32\CNHMCA.DLL
2009-09-01 09:58 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-09-01 09:58 13,568 a------- c:\windows\system32\CNC1737D.TBL
2009-08-28 12:52 <DIR> --d----- c:\program files\common files\CANON
2009-08-28 12:48 <DIR> --d----- c:\program files\Canon
2009-08-26 12:19 <DIR> --d----- c:\program files\DivX
2009-08-26 12:19 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-24 13:47 <DIR> --d----- c:\program files\PokerStars
2009-08-22 11:39 <DIR> --d----- c:\windows\system32\LogFiles
2009-08-21 20:15 32,592 a------- c:\windows\system32\msonpmon.dll
2009-08-21 20:09 <DIR> --d----- c:\windows\SHELLNEW
2009-08-07 22:32 <DIR> --d----- c:\program files\VideoLAN

==================== Find3M ====================

2009-09-03 17:49 37,888 a--sh--- c:\windows\system32\hibunevo.dll
2009-09-03 17:49 88,064 a--sh--- c:\windows\system32\nevorefa.dll
2009-09-03 17:47 11,308 a------- c:\program files\common files\ufylos.db
2009-06-29 09:30 256,712 a------- c:\windows\system32\PROUnstl.exe
2009-06-24 08:24 184,320 a------- c:\windows\system32\Ncs2Setp.dll
2009-06-24 08:15 764,536 a------- c:\windows\system32\ncs2dmix.dll
2009-06-24 08:15 539,256 a------- c:\windows\system32\accesor.dll
2009-06-24 07:55 141,944 a------- c:\windows\system32\ncs2instutility.dll
2009-06-24 07:46 1,620,600 a------- c:\windows\system32\ncscolib.dll
2009-06-17 17:31 43,319 a------- c:\windows\system32\nvModes.dat
2009-06-11 17:32 2,682,880 a------- c:\windows\system32\vcredist_x86.exe
2009-06-11 17:32 2,670,592 a------- c:\windows\system32\WLBCGCBPRO731.DLL
2009-06-11 17:32 2,220,032 a------- c:\windows\system32\WLTRAY.EXE
2009-06-11 17:32 65,536 a------- c:\windows\system32\wltrynt.dll
2009-06-11 17:32 24,064 a------- c:\windows\system32\WLTRYSVC.EXE
2009-06-11 17:32 1,961,984 a------- c:\windows\system32\BCMWLTRY.EXE
2009-06-11 17:32 286,720 a------- c:\windows\system32\bcmwlu00.exe
2009-06-11 17:32 69,632 a------- c:\windows\system32\bcmwlpkt.dll
2009-06-11 17:32 815,104 a------- c:\windows\system32\BCMLogon.dll
2009-06-11 17:32 753,664 a------- c:\windows\system32\bcm1xsup.dll
2009-06-11 17:32 143,360 a------- c:\windows\system32\bcmwlapi.dll
2009-06-11 17:11 410,984 a------- c:\windows\system32\deploytk.dll

============= FINISH: 16:13:24.76 ===============

mas_pogi · 09-04-2009, 06:47 PM

hi.

If you are having a hard time wth Gmer, try this one.

Download RootRepeal.zip to your Desktop and extract the compressed file to it's own folder.

Open the folder and doubleclick on RootRepeal.exe to run it.

Click on the Report tab, and then click on: Scan
A window opens asking what to include in the scan.
Check the following boxes then click OK:

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services
Shadow SSDT

You will then be asked which drive to scan.
Check C: (or the drive your operating system is installed on, if not C)
Click OK once again.
The tool will begin scanning and may take a while to complete, so please be patient.

When the scan finishes, click on: Save Report. Save it to your desktop so you may find it easily.

Please attach the report in your next reply.

Mark

Dannyeverett101 · 09-05-2009, 03:38 PM

New problem: When i start my computer it boots up normally with my normal background, but then when a program tries to autostart on my toolbar, a cloud comes up saying "Total security warning" and then tries to scan, I see that this is a scam trying to insert more viruses. The background is writing that tells me "Warning. Your in danger. Your computer is infected with spyware." It has a bunch of other writing below that about how [people like my "brother, sister parents, boss, can see my archived information"

It does let me start any programs or anything, so i cannot download that rootkit scanner to my computer anymore, how can i do this?

mas_pogi · 09-05-2009, 07:41 PM

hi.

Try rebooting into Safe Mode with Networking.
This can be done tapping the F8 key as soon as you start your computer
You will be brought to a menu where you can choose to boot into safe mode with networking.

Then start from there.

Mark

Dannyeverett101 · 09-06-2009, 07:48 PM

Got it working with GMER

Heres the logs:

DDS (Ver_09-07-30.01) - NTFSx86 NETWORK
Run by Danny Everett at 18:23:47.17 on Sun 09/06/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1708 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\DOCUME~1\DANNYE~1\LOCALS~1\Temp\Temporary Directory 1 for gmer (4).zip\gmer.exe
C:\Documents and Settings\Danny Everett\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.dell.com
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
mSearchAssistant = hxxp://www.google.com
mWinlogon: Taskman=c:\recycler\s-1-5-21-5648107829-8553251993-109501673-2833\msimfo32.exe
BHO: c:\windows\system32\tajf83ikdmf.dll: {bf56a325-23f2-42ad-f4e4-00aac39caa53} - c:\windows\system32\tajf83ikdmf.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Monopod] c:\docume~1\dannye~1\locals~1\temp\d.exe
uRun: [NordBull] c:\windows\msf.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [SecureUpgrade] "c:\program files\wave systems corp\SecureUpgrade.exe"
mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe"
mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe"
mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [DellConnectionManager] "c:\program files\dell\dell controlpoint\connection manager\Dell.UCM.exe"
mRun: [<NO NAME>]
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Antivirus Pro 2010] "c:\program files\antiviruspro_2010\AntivirusPro_2010.exe" /hide
mRun: [14675934] c:\documents and settings\all users\application data\14675934\14675934.exe
mRun: [deyisefaza] Rundll32.exe "c:\windows\system32\rijiraza.dll",s
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [nijajivey] Rundll32.exe "c:\windows\system32\venaniwi.dll",a
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
AppInit_DLLs: cru629.dat c:\windows\system32\serevudo.dll c:\windows\system32\venaniwi.dll
SSODL: lesagigup - {f05bb96b-1f8f-435d-b638-b36230bb5879} - c:\windows\system32\venaniwi.dll
STS: c:\windows\system32\tajf83ikdmf.dll: {bf56a325-23f2-42ad-f4e4-00aac39caa53} - c:\windows\system32\tajf83ikdmf.dll
STS: mujuzedij: {f05bb96b-1f8f-435d-b638-b36230bb5879} - c:\windows\system32\venaniwi.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Authentication Packages = msv1_0 wvauth
LSA: Notification Packages = scecli c:\windows\system32\serevudo.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dannye~1\applic~1\mozilla\firefox\profiles\4kii7g6s.default\
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

============= SERVICES / DRIVERS ===============

R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-6-11 239760]
S2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968]
S2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-12-29 320800]
S2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2009-1-22 808296]
S2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2009-1-22 20840]
S2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2009-2-6 443168]
S2 gupdate1ca268228fa8f56;Google Update Service (gupdate1ca268228fa8f56);c:\program files\google\update\GoogleUpdate.exe [2009-8-26 133104]
S2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2008-12-4 226640]
S2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2009-3-1 77824]
S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-6-11 112512]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [2007-4-19 42832]
S3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2009-6-11 32808]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\drivers\nvtsp50.sys --> c:\windows\system32\drivers\NvtSp50.sys [?]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [2009-6-11 232744]

=============== Created Last 30 ================

2009-09-04 17:16 150,016 a------- c:\windows\msf.exe
2009-09-04 16:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\14675934
2009-09-04 08:15 4 a------- c:\windows\system32\bincd32.dat
2009-09-04 08:14 150,016 a------- c:\windows\mse.exe
2009-09-03 22:09 <DIR> --d----- c:\program files\Protection System
2009-09-03 21:44 58 a------- c:\windows\ppp4.dat
2009-09-03 21:44 9 a------- c:\windows\system32\bennuar.old
2009-09-03 21:44 2 a------- c:\windows\ppp3.dat
2009-09-03 21:44 36 a------- c:\windows\system32\sysnet.dat
2009-09-03 21:44 19 a------- c:\windows\system32\sonhelp.htm
2009-09-03 21:43 <DIR> --d----- c:\program files\Windows Police Pro
2009-09-03 21:38 19,968 a------- c:\windows\system32\UACapbwuenwuu.dll
2009-09-03 21:38 1,249,280 a------- c:\windows\system32\UAClkrxehpljm.dll
2009-09-03 21:38 174 a------- c:\windows\system32\UACmppogrwrvm.dat
2009-09-03 21:38 6,567 a------- c:\windows\system32\uacinit.dll
2009-09-03 21:38 74,240 a------- c:\windows\system32\UACltyqxmogbo.dll
2009-09-03 21:38 24,064 a------- c:\windows\system32\UACxjixbhdhat.dll
2009-09-03 21:38 50,176 a------- c:\windows\system32\drivers\UACmxewsrsnty.sys
2009-09-03 21:38 <DIR> --d----- C:\spoolerlogs
2009-09-03 21:33 43 a------- c:\windows\system32\rotscxkrdqpuct.dat
2009-09-03 21:28 150,016 a------- c:\windows\msd.exe
2009-09-03 20:54 150,016 a------- c:\windows\msc.exe
2009-09-03 20:53 150,016 a------- c:\windows\msb.exe
2009-09-03 20:53 664 a------- c:\windows\system32\d3d9caps.dat
2009-09-03 17:47 19,601 a------- c:\windows\yreqozyd.bat
2009-09-03 17:47 16,404 a------- c:\windows\myjile.com
2009-09-03 17:47 15,576 a------- c:\windows\duwymohu.com
2009-09-03 17:47 13,321 a------- c:\windows\hoqiv.db
2009-09-03 17:47 13,287 a------- c:\windows\gehavufav.bin
2009-09-03 17:47 12,423 a------- c:\windows\raqojasyl.lib
2009-09-03 17:47 11,285 a------- c:\windows\axajogy.scr
2009-09-03 17:47 10,204 a------- c:\program files\common files\ehuvuxa.exe
2009-09-03 17:47 19,968 a------- c:\windows\system32\rotscxrdylqjbo.dll
2009-09-03 17:47 43,008 a------- c:\windows\system32\rotscxsdosenbf.dll
2009-09-03 17:47 1,573 a------- c:\windows\system32\rotscxikhwobrb.dat
2009-09-03 17:47 0 a------- c:\windows\system32\AVR09.exe
2009-09-03 17:47 0 a------- c:\windows\system32\winhelper.dll
2009-09-03 17:46 831 a------- c:\windows\system32\critical_warning.html
2009-09-03 17:43 15,000 a------- c:\windows\system32\tajf83ikdmf.dll
2009-09-03 17:30 <DIR> --ds---- c:\documents and settings\danny everett\UserData
2009-09-03 17:23 190,333 a------- c:\windows\system32\wisdstr.exe
2009-09-03 14:32 <DIR> --d----- c:\windows\system32\Service
2009-09-03 13:10 12,454 a------- C:\1517717697
2009-09-03 13:09 103,424 a------- C:\xvhu.exe
2009-09-03 13:09 22,016 a------- C:\emxtqjit.exe
2009-09-03 13:09 49,152 a------- C:\hpbyv.exe
2009-09-03 13:00 <DIR> --d----- c:\windows\system32\PreInstall
2009-09-03 12:38 <DIR> --d----- c:\documents and settings\danny everett\.housecall6.6
2009-09-03 12:30 19,376 a------- c:\program files\common files\gigasomyde.com
2009-09-03 12:30 18,909 a------- c:\windows\utyjivar.vbs
2009-09-03 12:30 17,775 a------- c:\windows\system32\atydug.dl
2009-09-03 12:30 16,704 a------- c:\windows\uvefuzyga.lib
2009-09-03 12:30 16,549 a------- c:\windows\system32\zadisylup.com
2009-09-03 12:30 16,536 a------- c:\windows\ipacimy.inf
2009-09-03 12:30 16,190 a------- c:\windows\yjaryxucy.pif
2009-09-03 12:30 15,142 a------- c:\windows\qulykog.bin
2009-09-03 12:30 14,968 a------- c:\windows\system32\obahoj.db
2009-09-03 12:30 13,757 a------- c:\windows\jilazalil._dl
2009-09-03 12:30 12,195 a------- c:\windows\anufucojyf._sy
2009-09-03 12:30 11,411 a------- c:\docume~1\alluse~1\applic~1\yzebaziwe.bin
2009-09-03 12:30 11,352 a------- c:\docume~1\alluse~1\applic~1\nare.dat
2009-09-03 12:30 10,265 a------- c:\windows\zynol.db
2009-09-03 12:29 <DIR> --d----- c:\program files\AVG
2009-09-03 12:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-09-03 12:27 <DIR> --d----- c:\docume~1\dannye~1\applic~1\AVG8
2009-09-03 11:18 150,528 a------- c:\windows\msa.exe
2009-09-02 17:59 <DIR> --d----- c:\windows\system32\SoftwareDistribution
2009-09-02 12:52 1,904 -------- c:\windows\system32\SetupBD.din
2009-09-02 12:45 <DIR> --d----- c:\docume~1\dannye~1\applic~1\Blitware
2009-09-02 09:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DellUCM
2009-09-01 09:58 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-09-01 09:58 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-09-01 09:58 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-09-01 09:58 1,331,200 a------- c:\windows\system32\CNC330C.DLL
2009-09-01 09:58 274,432 a------- c:\windows\system32\CNC330L.DLL
2009-09-01 09:58 192,512 a------- c:\windows\system32\CNC330O.DLL
2009-09-01 09:58 98,304 a------- c:\windows\system32\CNC330I.DLL
2009-09-01 09:58 15,872 a------- c:\windows\system32\CNHMCA.DLL
2009-09-01 09:58 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-09-01 09:58 13,568 a------- c:\windows\system32\CNC1737D.TBL
2009-08-28 12:52 <DIR> --d----- c:\program files\common files\CANON
2009-08-28 12:48 <DIR> --d----- c:\program files\Canon
2009-08-26 12:19 <DIR> --d----- c:\program files\DivX
2009-08-26 12:19 <DIR> --d----- c:\program files\common files\DivX Shared
2009-08-24 13:47 <DIR> --d----- c:\program files\PokerStars
2009-08-22 11:39 <DIR> --d----- c:\windows\system32\LogFiles
2009-08-21 20:15 32,592 a------- c:\windows\system32\msonpmon.dll
2009-08-21 20:09 <DIR> --d----- c:\windows\SHELLNEW
2009-08-07 22:32 <DIR> --d----- c:\program files\VideoLAN

==================== Find3M ====================

2009-09-06 18:18 88,576 a--sh--- c:\windows\system32\venaniwi.dll
2009-09-06 18:18 37,888 a--sh--- c:\windows\system32\depiwore.dll
2009-09-05 14:34 88,064 a--sh--- c:\windows\system32\kefuguhi.dll
2009-09-05 14:34 37,888 a--sh--- c:\windows\system32\suhahebu.dll
2009-09-05 14:34 24,490 a--sh--- c:\windows\system32\zukepive.exe
2009-09-04 16:32 49,664 a--sh--- c:\windows\system32\yefanopa.dll
2009-09-04 16:31 831,524 a--sh--- c:\windows\system32\zusudupe.exe
2009-09-04 16:31 37,376 a--sh--- c:\windows\system32\linivini.dll
2009-09-03 17:49 37,888 a--sh--- c:\windows\system32\hibunevo.dll
2009-09-03 17:47 11,308 a------- c:\program files\common files\ufylos.db
2009-06-29 09:30 256,712 a------- c:\windows\system32\PROUnstl.exe
2009-06-24 08:24 184,320 a------- c:\windows\system32\Ncs2Setp.dll
2009-06-24 08:15 764,536 a------- c:\windows\system32\ncs2dmix.dll
2009-06-24 08:15 539,256 a------- c:\windows\system32\accesor.dll
2009-06-24 07:55 141,944 a------- c:\windows\system32\ncs2instutility.dll
2009-06-24 07:46 1,620,600 a------- c:\windows\system32\ncscolib.dll
2009-06-17 17:31 43,319 a------- c:\windows\system32\nvModes.dat
2009-06-11 17:32 2,682,880 a------- c:\windows\system32\vcredist_x86.exe
2009-06-11 17:32 2,670,592 a------- c:\windows\system32\WLBCGCBPRO731.DLL
2009-06-11 17:32 2,220,032 a------- c:\windows\system32\WLTRAY.EXE
2009-06-11 17:32 65,536 a------- c:\windows\system32\wltrynt.dll
2009-06-11 17:32 24,064 a------- c:\windows\system32\WLTRYSVC.EXE
2009-06-11 17:32 1,961,984 a------- c:\windows\system32\BCMWLTRY.EXE
2009-06-11 17:32 286,720 a------- c:\windows\system32\bcmwlu00.exe
2009-06-11 17:32 69,632 a------- c:\windows\system32\bcmwlpkt.dll
2009-06-11 17:32 815,104 a------- c:\windows\system32\BCMLogon.dll
2009-06-11 17:32 753,664 a------- c:\windows\system32\bcm1xsup.dll
2009-06-11 17:32 143,360 a------- c:\windows\system32\bcmwlapi.dll
2009-06-11 17:11 410,984 a------- c:\windows\system32\deploytk.dll

============= FINISH: 18:23:58.12 ===============

mas_pogi · 09-07-2009, 04:04 AM

hi.

Your system is really infected. Please bear with me.

You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe

-------------------------------------------------------------------------
Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

-----------------------------------------------------------------------
I am sorry to inform you that one or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

----------------------------------------------------------------------

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

--------------------------------------------------------------------------

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. You can find instructions HERE.

AVG 8.5
Please open the AVG 8.5 Control Center, by right clicking on the AVG icon on task bar.
- Click on Open AVG Interface.
- Double click on Resident Shield
- Deselect the option to "Enable Resident Shield."
- Save changes, and exit the application.
- To re-enable AVG 8.5 later, please select "Enable Resident Shield" again.
Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*re-enable all your security application after the fix.

Mark

Dannyeverett101 · 09-07-2009, 03:20 PM

I am booting in safe mode and there is no icon for AVG on the tray, but it says AVG free is running when i try and use Combo-Fix

i tried going to control panel, add and remove programs but AVG wasnt listed, then i searched for AVG files and found a folder called AVG and one called AVG8. I tried deleting them to get rid of AVG but it didnt work.

How can i disable this?

mas_pogi · 09-07-2009, 04:34 PM

hi.

Please continue running Combofix. And post the result here.

Mark

Dannyeverett101 · 09-07-2009, 05:13 PM

My computer after running combofix is already running incredibly smoother, but im sure its not clean...here is the log

ComboFix 09-09-06.06 - Danny Everett 09/07/2009 16:02.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1665 [GMT -7:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ADMINI~1\LOCALS~1\Temp\csrss.exe
c:\docume~1\ADMINI~1\LOCALS~1\Temp\lsass.exe
c:\docume~1\ADMINI~1\LOCALS~1\Temp\services.exe
c:\docume~1\ADMINI~1\LOCALS~1\Temp\svchost.exe
c:\documents and settings\All Users\Application Data\14675934
c:\documents and settings\All Users\Application Data\14675934\14675934
c:\documents and settings\All Users\Application Data\14675934\14675934.exe
c:\documents and settings\All Users\Application Data\14675934\pc14675934ins
c:\documents and settings\All Users\Application Data\yzebaziwe.bin
c:\documents and settings\All Users\Documents\qugab.exe
c:\documents and settings\All Users\Documents\qunu.inf
c:\documents and settings\All Users\Documents\sebugasa._dl
c:\documents and settings\Danny Everett\Application Data\caromaku._sy
c:\documents and settings\Danny Everett\Application Data\cuwudylevu.inf
c:\documents and settings\Danny Everett\Application Data\ibim.lib
c:\documents and settings\Danny Everett\Application Data\ilapa.dl
c:\documents and settings\Danny Everett\Cookies\dyqumucyb.ban
c:\documents and settings\Danny Everett\Cookies\ibevuqukef.pif
c:\documents and settings\Danny Everett\Cookies\nybyhoqyre.dll
c:\documents and settings\Danny Everett\Cookies\ybemo.dll
c:\documents and settings\Danny Everett\Local Settings\Application Data\fefecyliz.dl
c:\documents and settings\Danny Everett\Local Settings\Application Data\ocyvugotun.scr
c:\documents and settings\Danny Everett\Local Settings\Application Data\uzykyluqu.dll
c:\documents and settings\Danny Everett\Local Settings\Application Data\yfolakid.inf
c:\documents and settings\Danny Everett\Local Settings\Temporary Internet Files\aqijo._sy
c:\documents and settings\Danny Everett\Local Settings\Temporary Internet Files\doqopeby.pif
c:\documents and settings\Danny Everett\Local Settings\Temporary Internet Files\nigyzopa.lib
c:\documents and settings\Danny Everett\Local Settings\Temporary Internet Files\xuhajabuci.reg
C:\emxtqjit.exe
C:\hpbyv.exe
c:\program files\Common Files\ehuvuxa.exe
c:\program files\Common Files\gigasomyde.com
c:\program files\Protection System
c:\recycler\S-1-5-21-5648107829-8553251993-109501673-2833
c:\windows\axajogy.scr
c:\windows\gehavufav.bin
c:\windows\ipacimy.inf
c:\windows\jilazalil._dl
c:\windows\msa.exe
c:\windows\msb.exe
c:\windows\msc.exe
c:\windows\msd.exe
c:\windows\mse.exe
c:\windows\msf.exe
c:\windows\ppp3.dat
c:\windows\ppp4.dat
c:\windows\qulykog.bin
c:\windows\system32\atydug.dl
c:\windows\system32\AVR09.exe
c:\windows\system32\bennuar.old
c:\windows\system32\bincd32.dat
c:\windows\system32\critical_warning.html
c:\windows\system32\depiwore.dll
c:\windows\system32\drivers\rotscxpxwqenot.sys
c:\windows\system32\drivers\UACmxewsrsnty.sys
c:\windows\system32\hibunevo.dll
c:\windows\system32\linivini.dll
c:\windows\system32\rotscxikhwobrb.dat
c:\windows\system32\rotscxkrdqpuct.dat
c:\windows\system32\rotscxrdylqjbo.dll
c:\windows\system32\rotscxsdosenbf.dll
c:\windows\system32\serevudo.dll
c:\windows\system32\sonhelp.htm
c:\windows\system32\suhahebu.dll
c:\windows\system32\sysnet.dat
c:\windows\system32\tajf83ikdmf.dll
c:\windows\system32\UACapbwuenwuu.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClkrxehpljm.dll
c:\windows\system32\UACltyqxmogbo.dll
c:\windows\system32\UACmppogrwrvm.dat
c:\windows\system32\UACxjixbhdhat.dll
c:\windows\system32\wilawibe.dll
c:\windows\system32\winhelper.dll
c:\windows\system32\wisdstr.exe
c:\windows\system32\zukepive.exe
c:\windows\system32\zusudupe.exe
c:\windows\utyjivar.vbs
c:\windows\yjaryxucy.pif
c:\windows\yreqozyd.bat
C:\xvhu.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_rotscxrgkvrttq
-------\Legacy_rotscxrgkvrttq
-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Legacy_ANTIPPRO2009_100
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-08-07 to 2009-09-07 )))))))))))))))))))))))))))))))
.

2009-09-07 21:21 . 2009-09-07 21:21 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-07 21:16 . 2009-09-07 21:16 -------- d-----w- c:\program files\AVG
2009-09-07 21:12 . 2009-09-07 21:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2009-09-07 21:06 . 2009-09-07 21:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-09-07 21:05 . 2009-09-07 21:05 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-09-07 02:47 . 2009-09-07 02:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-05 00:22 . 2009-09-05 00:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-04 04:38 . 2009-09-04 04:38 -------- d-----w- C:\spoolerlogs
2009-09-04 03:53 . 2009-09-04 04:28 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-04 00:47 . 2009-09-04 00:47 18989 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\yrynysum.dat
2009-09-04 00:47 . 2009-09-04 00:47 16404 ----a-w- c:\windows\myjile.com
2009-09-04 00:47 . 2009-09-04 00:47 15576 ----a-w- c:\windows\duwymohu.com
2009-09-04 00:30 . 2009-09-04 00:30 -------- d-s---w- c:\documents and settings\Danny Everett\UserData
2009-09-03 21:32 . 2009-09-03 21:32 -------- d-----w- c:\windows\system32\Service
2009-09-03 21:29 . 2009-09-03 21:29 -------- d-----w- c:\program files\Alwil Software
2009-09-03 19:38 . 2009-09-03 19:38 -------- d-----w- c:\documents and settings\Danny Everett\.housecall6.6
2009-09-03 19:30 . 2009-09-03 19:30 16549 ----a-w- c:\windows\system32\zadisylup.com
2009-09-03 19:29 . 2009-09-03 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-03 19:27 . 2009-09-03 19:27 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\AVG8
2009-09-03 00:25 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-09-03 00:24 . 2009-09-03 00:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-03 00:23 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Adobe
2009-09-02 19:45 . 2009-09-02 19:45 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\Blitware
2009-09-02 16:53 . 2009-09-02 16:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DellUCM
2009-09-01 16:58 . 2008-04-14 07:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-09-01 16:58 . 2008-04-14 07:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-09-01 16:58 . 2008-10-07 18:20 1331200 ----a-w- c:\windows\system32\CNC330C.DLL
2009-09-01 16:58 . 2008-10-07 18:20 98304 ----a-w- c:\windows\system32\CNC330I.DLL
2009-09-01 16:58 . 2008-10-01 20:46 274432 ----a-w- c:\windows\system32\CNC330L.DLL
2009-09-01 16:58 . 2008-08-26 01:02 15872 ----a-w- c:\windows\system32\CNHMCA.DLL
2009-09-01 16:58 . 2008-07-16 16:39 192512 ----a-w- c:\windows\system32\CNC330O.DLL
2009-09-01 16:58 . 2008-04-14 07:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-09-01 16:58 . 2008-04-14 07:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-28 19:52 . 2009-08-28 19:52 -------- d-----w- c:\program files\Common Files\CANON
2009-08-28 19:48 . 2009-09-01 16:59 -------- d-----w- c:\program files\Canon
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\windows\Sun
2009-08-26 19:42 . 2009-08-26 19:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:32 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\DivX
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-08-24 20:47 . 2009-09-02 22:21 -------- d-----w- c:\program files\PokerStars
2009-08-22 18:39 . 2009-08-22 18:39 -------- d-----w- c:\windows\system32\LogFiles
2009-08-22 03:15 . 2006-10-27 02:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft Works
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft.NET
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\windows\SHELLNEW
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:08 -------- d--h--r- C:\MSOCache
2009-08-22 03:05 . 2009-08-22 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-07 23:08 . 2009-06-18 00:30 0 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\WavXMapDrive.bat
2009-09-07 21:02 . 2009-06-07 21:02 88064 --sha-w- c:\windows\system32\muzupera.dll
2009-09-07 02:41 . 2009-08-08 05:33 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\vlc
2009-09-07 01:18 . 2009-06-07 01:18 88576 --sha-w- c:\windows\system32\venaniwi.dll
2009-09-05 21:34 . 2009-06-05 21:34 88064 --sha-w- c:\windows\system32\kefuguhi.dll
2009-09-04 23:32 . 2009-06-04 23:31 49664 --sha-w- c:\windows\system32\yefanopa.dll
2009-09-04 23:30 . 2009-06-12 00:30 28824 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 23:12 . 2009-07-01 21:36 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\FrostWire
2009-09-04 22:35 . 2009-06-12 00:43 28824 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 00:47 . 2009-09-04 00:47 11308 ----a-w- c:\program files\Common Files\ufylos.db
2009-09-03 19:30 . 2009-09-03 19:30 11352 ----a-w- c:\documents and settings\All Users\Application Data\nare.dat
2009-09-02 19:52 . 2009-06-12 00:24 -------- d-----w- c:\program files\Intel
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\program files\CanonBJ
2009-08-08 05:32 . 2009-08-08 05:32 -------- d-----w- c:\program files\VideoLAN
2009-06-29 16:30 . 2009-06-12 06:58 256712 ----a-w- c:\windows\system32\PROUnstl.exe
2009-06-24 15:24 . 2009-06-24 15:24 184320 ----a-w- c:\windows\system32\Ncs2Setp.dll
2009-06-24 15:15 . 2009-06-24 15:15 764536 ----a-w- c:\windows\system32\ncs2dmix.dll
2009-06-24 15:15 . 2009-06-24 15:15 539256 ----a-w- c:\windows\system32\accesor.dll
2009-06-24 14:55 . 2009-06-24 14:55 141944 ----a-w- c:\windows\system32\ncs2instutility.dll
2009-06-24 14:46 . 2009-06-24 14:46 1620600 ----a-w- c:\windows\system32\ncscolib.dll
2009-06-24 07:54 . 2009-06-24 07:54 30880 ----a-w- c:\windows\system32\drivers\iqvw32.sys
2009-06-19 16:22 . 2009-06-19 16:22 0 ----a-w- c:\windows\nsreg.dat
2009-06-18 00:31 . 2009-06-12 00:00 43319 ----a-w- c:\windows\system32\nvModes.dat
2009-06-12 00:44 . 2009-06-18 00:30 12912 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 00:43 . 2009-06-12 00:43 0 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat
2009-06-12 00:11 . 2009-06-12 00:11 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-06-04 23:32 . 2009-06-04 23:32 49664 --sha-w- c:\windows\system32\loseteni.dll
2009-06-04 23:32 . 2009-06-04 23:32 49664 --sha-w- c:\windows\system32\rijiraza.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0e039e2b-6210-4da4-901d-85a89427dede}]
2009-06-04 23:32 49664 --sha-w- c:\windows\system32\loseteni.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-22 200704]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-17 483420]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-03-17 729088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-28 13537280]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-28 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 136600]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-12-19 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-12-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2009-01-16 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2009-01-16 95544]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-01-19 667648]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2009-01-16 15360]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-06-12 2220032]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-03-01 1810432]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"deyisefaza"="c:\windows\system32\rijiraza.dll" [2009-06-04 49664]
"nijajivey"="c:\windows\system32\venaniwi.dll" [2009-09-07 88576]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-08-28 1630208]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-08-28 90112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-2-6 1095456]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{f05bb96b-1f8f-435d-b638-b36230bb5879}"= "c:\windows\system32\venaniwi.dll" [2009-09-07 88576]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"lesagigup"= {f05bb96b-1f8f-435d-b638-b36230bb5879} - c:\windows\system32\venaniwi.dll [2009-09-07 88576]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IDT\\WDM\\sttray.exe"=

R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 3:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [12/29/2008 9:07 AM 320800]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [1/22/2009 8:19 AM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [1/22/2009 8:19 AM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2/6/2009 6:06 PM 443168]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [3/1/2009 4:09 PM 77824]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [6/11/2009 7:52 PM 112512]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [6/11/2009 7:52 PM 32808]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [6/11/2009 7:52 PM 239760]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [6/11/2009 5:36 PM 232744]
S2 gupdate1ca268228fa8f56;Google Update Service (gupdate1ca268228fa8f56);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 12:19 PM 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [4/19/2007 3:28 AM 42832]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys --> c:\windows\system32\Drivers\NvtSp50.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-09-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-09-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]

2009-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-Antivirus Pro 2010 - c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe
HKLM-Run-14675934 - c:\documents and settings\All Users\Application Data\14675934\14675934.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Danny Everett\Application Data\Mozilla\Firefox\Profiles\4kii7g6s.default\
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-07 16:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(940)
c:\windows\System32\TdmNetworkProvider.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\wvauth.dll

- - - - - - - > 'explorer.exe'(1372)
c:\windows\system32\venaniwi.dll
c:\windows\system32\rijiraza.dll
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\drivers\audio\R213367\stacsv.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\hidfind.exe
c:\program files\DellTPad\ApntEx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\windows\system32\searchindexer.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\searchfilterhost.exe
c:\windows\system32\searchprotocolhost.exe
.
**************************************************************************
.
Completion time: 2009-09-07 16:10 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-07 23:10

Pre-Run: 116,576,202,752 bytes free
Post-Run: 116,818,358,272 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

363 --- E O F --- 2009-09-03 20:00

mas_pogi · 09-08-2009, 06:57 AM

hi.

Quote:

My computer after running combofix is already running incredibly smoother, but im sure its not clean...here is the log

Yep. You are not clean yet.

About your Antivirus, did you installed avast before? What happened to avast? Also for your AVG, is it working properly before the virus struck down your computer?

Let me know.

Continue with instruction below.

Please go to: VirusTotal

On the page you'll find a Browse button.
Next to the Browse button you'll see a box to enter text.
Please copy/paste the following bolded text into the box:

c:\windows\system32\CNC330L.DLL
Then click the Send File button just below.
This will scan the file. Please be patient.
If you get a message saying File has already been analysed: click Reanalyse file now
Once scanned, copy and paste the results in your next reply.
Please repeat for the following files:
- c:\windows\system32\CNHMCA.DLL

-----------------------------------------------------------------------

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

--------------------------------------------------------------------------
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. You can find instructions HERE.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/411166-problem-computer.html#post2332080

COLLECT::
c:\documents and settings\Danny Everett\Local Settings\Application Data\yrynysum.dat
c:\windows\myjile.com
c:\windows\duwymohu.com
c:\windows\system32\zadisylup.com
c:\windows\system32\muzupera.dll
c:\windows\system32\venaniwi.dll
c:\windows\system32\yefanopa.dll
c:\program files\Common Files\ufylos.db
c:\documents and settings\All Users\Application Data\nare.dat
c:\windows\system32\loseteni.dll
c:\windows\system32\rijiraza.dll
FOLDER::
C:\spoolerlogs
c:\documents and settings\Danny Everett\.housecall6.6
FILE::
c:\windows\system32\kefuguhi.dll
REGISTRY::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000000

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

**Note**

When CF finishes running, it pops out with the CF log and this message box:

Clicking OK will begin the auto-upload of the zipped file.

-----------

If you do not get a message box, please do the following:

There should be a file named [4]-Submit_date@time.zip with today's date, located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

Please let me know if you successfully submitted the file.

------------------------------------------------------------------------

Please uninstall the following. Using windows ADD/REMOVE program at the control panel.

P2P program

FrostWire 4.18.0 ( Perils of P2P File Sharing )

-------------------------------------------------------------------------

Your Java is out of date.

Java(TM) 6 Update 11 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts.

------------------------------------------------------------------------

Run ESET Online Scan

*Close any open programs
*Turn off the real time scanner of any existing antivirus program while performing the online scan. You can find the instructions You can find instructions HERE.

Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

--------------------------------------------------------------------------
*note
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

In your reply, please post

C:\combofix.txt
ESET scan result <-attached
Virustotal scan result
Answer to my questions

Mark

Dannyeverett101 · 09-08-2009, 10:53 AM

EDIT: Made a mistake in this post and posted the previous combofix.txt, not the new one...the new one will be up shortly disregard the text i had in this post referring the Combofix.txt is you already read it before i removed it from the post

I did download and run avast but eventually i removed it because it wasnt working properly...AVG wouldn't complete the install when i tried to install it. I tried both avast and AVG after my computer was already infected, not before.

Here is the scan for the first file: CNC330L.DLL

File CNC330L.DLL received on 2009.09.08 16:21:38 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/41 (0%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 43 and 62 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.09.08 -
AhnLab-V3 5.0.0.2 2009.09.08 -
AntiVir 7.9.1.12 2009.09.08 -
Antiy-AVL 2.0.3.7 2009.09.08 -
Authentium 5.1.2.4 2009.09.08 -
Avast 4.8.1351.0 2009.09.08 -
AVG 8.5.0.409 2009.09.08 -
BitDefender 7.2 2009.09.08 -
CAT-QuickHeal 10.00 2009.09.08 -
ClamAV 0.94.1 2009.09.08 -
Comodo 2204 2009.09.08 -
DrWeb 5.0.0.12182 2009.09.08 -
eSafe 7.0.17.0 2009.09.08 -
eTrust-Vet 31.6.6725 2009.09.08 -
F-Prot 4.5.1.85 2009.09.08 -
F-Secure 8.0.14470.0 2009.09.08 -
Fortinet 3.120.0.0 2009.09.08 -
GData 19 2009.09.08 -
Ikarus T3.1.1.72.0 2009.09.08 -
Jiangmin 11.0.800 2009.09.08 -
K7AntiVirus 7.10.839 2009.09.08 -
Kaspersky 7.0.0.125 2009.09.08 -
McAfee 5735 2009.09.08 -
McAfee+Artemis 5735 2009.09.08 -
McAfee-GW-Edition 6.8.5 2009.09.08 -
Microsoft 1.5005 2009.09.08 -
NOD32 4406 2009.09.08 -
Norman 6.01.09 2009.09.08 -
nProtect 2009.1.8.0 2009.09.08 -
Panda 10.0.2.2 2009.09.07 -
PCTools 4.4.2.0 2009.09.07 -
Prevx 3.0 2009.09.08 -
Rising 21.46.14.00 2009.09.08 -
Sophos 4.45.0 2009.09.08 -
Sunbelt 3.2.1858.2 2009.09.07 -
Symantec 1.4.4.12 2009.09.08 -
TheHacker 6.3.4.3.397 2009.09.07 -
TrendMicro 8.950.0.1094 2009.09.08 -
VBA32 3.12.10.10 2009.09.08 -
ViRobot 2009.9.8.1923 2009.09.08 -
VirusBuster 4.6.5.0 2009.09.08 -
Additional information
File size: 274432 bytes
MD5...: a94af70a5c5cf313d42d5996663a21e6
SHA1..: a02167b7a0c5e4fee8ce9e6ca5bf009246577121
SHA256: 7c766ae019a0b05ae0527bb0415eccafcd81c3540f89b6180b43d28d9b95e5c4
ssdeep: 6144:XASPSzpjieA3UUBvBjiX60jlAOXEjgQZRIw0:LPSz23pvMVx9QcN
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1fa0f
timedatestamp.....: 0x48e300b1 (Wed Oct 01 04:46:41 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x306de 0x31000 6.66 2e0b249da065c452c0af601e0a1f2a36
.rdata 0x32000 0x992d 0xa000 5.97 a6160fd7d3eda48f6a0ed7d98760436f
.data 0x3c000 0x4180 0x3000 3.29 fd755f81b7d5f1ea9e273b322815b63e
.rsrc 0x41000 0x3c4 0x1000 3.67 d62f5965f5272b18ad99871a6e2a12a2
.reloc 0x42000 0x2b12 0x3000 4.87 ff2031842ebc3c122489eae627e7c14b

( 4 imports )
> KERNEL32.dll: WaitForMultipleObjects, CreateThread, DeleteCriticalSection, InitializeCriticalSection, UnmapViewOfFile, MapViewOfFile, GetLastError, CreateFileMappingA, GetVersionExA, GetLocalTime, LeaveCriticalSection, EnterCriticalSection, CreateMutexA, ReleaseMutex, FormatMessageA, GetModuleFileNameA, GetModuleHandleA, FreeLibrary, ResetEvent, LoadLibraryA, WideCharToMultiByte, GetFileSize, CreateFileA, ExitThread, GetExitCodeThread, GetSystemDirectoryA, MultiByteToWideChar, HeapFree, HeapAlloc, GetProcessHeap, DeviceIoControl, WriteFile, ReadFile, GetOverlappedResult, SetEnvironmentVariableA, CompareStringW, CompareStringA, WriteConsoleW, GetConsoleOutputCP, CreateEventA, SetEvent, WaitForSingleObject, CloseHandle, GetTempPathA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetProcAddress, Sleep, RtlUnwind, RaiseException, GetSystemTimeAsFileTime, GetTimeZoneInformation, GetCurrentThreadId, GetCommandLineA, VirtualFree, VirtualAlloc, HeapReAlloc, HeapDestroy, HeapCreate, ExitProcess, GetStdHandle, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, LCMapStringA, LCMapStringW, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, SetFilePointer, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers, WriteConsoleA, SetEndOfFile
> USER32.dll: wsprintfA
> WINSPOOL.DRV: EnumMonitorsA, EnumPortsA
> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegCloseKey, ImpersonateSelf, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RevertToSelf, RegOpenKeyA

( 29 exports )
_FindScannerEx_Network@@YGHPAPAXPBDG@Z, DoCalibration, FindScannerEx, GetAGData, GetCalibrationStatus, GetCanonAPIVersion, GetCropStatus, GetDataStatus, GetLampStatus, GetOPUMode, GetReadStatus, GetScannerAbilitySize, GetScannerAbilityXp, GetScannerStatus, InitialButton, InitializeScanner, LockScanner, ReadPushButton, ReadScan, SetAGData, SetErrorToDevice, SetGamma, SetLamp, SetScanParameter, StartScanEx, StopScanEx, TerminateScanner, TestScanner, UnlockScanner
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)

Here is the log for CNHMCA.DLL

File CNHMCA.DLL received on 2009.09.08 16:52:25 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/41 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 52 and 75 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.09.08 -
AhnLab-V3 5.0.0.2 2009.09.08 -
AntiVir 7.9.1.12 2009.09.08 -
Antiy-AVL 2.0.3.7 2009.09.08 -
Authentium 5.1.2.4 2009.09.08 -
Avast 4.8.1351.0 2009.09.08 -
AVG 8.5.0.409 2009.09.08 -
BitDefender 7.2 2009.09.08 -
CAT-QuickHeal 10.00 2009.09.08 -
ClamAV 0.94.1 2009.09.08 -
Comodo 2204 2009.09.08 -
DrWeb 5.0.0.12182 2009.09.08 -
eSafe 7.0.17.0 2009.09.08 -
eTrust-Vet 31.6.6725 2009.09.08 -
F-Prot 4.5.1.85 2009.09.08 -
F-Secure 8.0.14470.0 2009.09.08 -
Fortinet 3.120.0.0 2009.09.08 -
GData 19 2009.09.08 -
Ikarus T3.1.1.72.0 2009.09.08 -
Jiangmin 11.0.800 2009.09.08 -
K7AntiVirus 7.10.839 2009.09.08 -
Kaspersky 7.0.0.125 2009.09.08 -
McAfee 5735 2009.09.08 -
McAfee+Artemis 5735 2009.09.08 -
McAfee-GW-Edition 6.8.5 2009.09.08 -
Microsoft 1.5005 2009.09.08 -
NOD32 4407 2009.09.08 -
Norman 6.01.09 2009.09.08 -
nProtect 2009.1.8.0 2009.09.08 -
Panda 10.0.2.2 2009.09.08 -
PCTools 4.4.2.0 2009.09.07 -
Prevx 3.0 2009.09.08 -
Rising 21.46.14.00 2009.09.08 -
Sophos 4.45.0 2009.09.08 -
Sunbelt 3.2.1858.2 2009.09.07 -
Symantec 1.4.4.12 2009.09.08 -
TheHacker 6.3.4.3.397 2009.09.07 -
TrendMicro 8.950.0.1094 2009.09.08 -
VBA32 3.12.10.10 2009.09.08 -
ViRobot 2009.9.8.1923 2009.09.08 -
VirusBuster 4.6.5.0 2009.09.08 -
Additional information
File size: 15872 bytes
MD5...: d16cf34b17899f90a8fcf2a3f77b4a27
SHA1..: 04859b5ff64adb10b066c64900d6c6020863d1f1
SHA256: 131f14b234f08e7c9e1bb30836f2459ce7cf468b6968e9b161982d3b52e77e21
ssdeep: 384:z0n63Suk/MSnK4/rQHP0KJTdSO48ISCLsfrT:zH3luMeK4cHMKv3GYf3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x23e6
timedatestamp.....: 0x48b27523 (Mon Aug 25 09:02:27 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x30cf 0x3200 6.46 d81107d765c68f6f4c709802fab5f601
.data 0x5000 0x32c 0x200 0.18 f82d0414c3e3ade164d998c76d9eaef7
.rsrc 0x6000 0x3f8 0x400 3.28 957d8f58c63f145146965f216ebb6cbc
.reloc 0x7000 0x106 0x200 1.93 6ad735d350034c82d4a76764e0b41590

( 1 imports )
> KERNEL32.dll: DisableThreadLibraryCalls, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GlobalAlloc, GlobalFree, CloseHandle, ReadFile, SetFilePointer, CreateFileW, MultiByteToWideChar

( 6 exports )
CSFreeTable, CSGetCategoryInfoS, CSGetCategoryInfoV, CSGetMainInfo, CSGetTable, CSGetTableFormatType
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

Other instructions coming in next post because i must close my browser now to do the combofix instructions

Dannyeverett101 · 09-08-2009, 11:31 AM

Here is the combofix log

ComboFix 09-09-08.01 - Danny Everett 09/08/2009 10:22.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1508 [GMT -7:00]
Running from: c:\documents and settings\Danny Everett\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Danny Everett\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\kefuguhi.dll"

file zipped: c:\documents and settings\All Users\Application Data\nare.dat
file zipped: c:\documents and settings\Danny Everett\Local Settings\Application Data\yrynysum.dat
file zipped: c:\program files\Common Files\ufylos.db
file zipped: c:\windows\duwymohu.com
file zipped: c:\windows\myjile.com
file zipped: c:\windows\system32\loseteni.dll
file zipped: c:\windows\system32\muzupera.dll
file zipped: c:\windows\system32\rijiraza.dll
file zipped: c:\windows\system32\venaniwi.dll
file zipped: c:\windows\system32\yefanopa.dll
file zipped: c:\windows\system32\zadisylup.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\nare.dat
c:\documents and settings\Danny Everett\.housecall6.6
c:\documents and settings\Danny Everett\.housecall6.6\8ball.txt
c:\documents and settings\Danny Everett\.housecall6.6\AU_Log\TmuDump.txt
c:\documents and settings\Danny Everett\.housecall6.6\aucfg.ini
c:\documents and settings\Danny Everett\.housecall6.6\BPMNT.dll
c:\documents and settings\Danny Everett\.housecall6.6\ciussi32.dll
c:\documents and settings\Danny Everett\.housecall6.6\dsvout.dll
c:\documents and settings\Danny Everett\.housecall6.6\engine.stat
c:\documents and settings\Danny Everett\.housecall6.6\getMac.exe
c:\documents and settings\Danny Everett\.housecall6.6\GetServer.ini
c:\documents and settings\Danny Everett\.housecall6.6\jsapi.dll
c:\documents and settings\Danny Everett\.housecall6.6\jupdate.dll
c:\documents and settings\Danny Everett\.housecall6.6\local.conf
c:\documents and settings\Danny Everett\.housecall6.6\log\2009-09-03-12-37-47.pending
c:\documents and settings\Danny Everett\.housecall6.6\log\dsvout.log
c:\documents and settings\Danny Everett\.housecall6.6\log\engine0.log
c:\documents and settings\Danny Everett\.housecall6.6\log\error0.log
c:\documents and settings\Danny Everett\.housecall6.6\log\execution0.log
c:\documents and settings\Danny Everett\.housecall6.6\patch.exe
c:\documents and settings\Danny Everett\.housecall6.6\PATCHW32.DLL
c:\documents and settings\Danny Everett\.housecall6.6\Pattern\lpt$vpn.415
c:\documents and settings\Danny Everett\.housecall6.6\Pattern\tmaptn.819
c:\documents and settings\Danny Everett\.housecall6.6\Pattern\TMVAmain.ptn
c:\documents and settings\Danny Everett\.housecall6.6\Pattern\tsc.ptn
c:\documents and settings\Danny Everett\.housecall6.6\ssapi32.dll
c:\documents and settings\Danny Everett\.housecall6.6\ssapiptn.da5
c:\documents and settings\Danny Everett\.housecall6.6\tmcomm.sys
c:\documents and settings\Danny Everett\.housecall6.6\TmEngDrv.dll
c:\documents and settings\Danny Everett\.housecall6.6\TmUpdate.dll
c:\documents and settings\Danny Everett\.housecall6.6\tsc.exe
c:\documents and settings\Danny Everett\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip
c:\documents and settings\Danny Everett\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\ini_xml.zip.etag
c:\documents and settings\Danny Everett\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini
c:\documents and settings\Danny Everett\.housecall6.6\Update\AU_Cache\housecall65.trendmicro.com\server.ini.etag
c:\documents and settings\Danny Everett\.housecall6.6\usrbl.dat
c:\documents and settings\Danny Everett\.housecall6.6\usrwl.dat
c:\documents and settings\Danny Everett\.housecall6.6\vsapi32.dll
c:\documents and settings\Danny Everett\.housecall6.6\vscan.dat
c:\documents and settings\Danny Everett\Local Settings\Application Data\yrynysum.dat
c:\program files\Common Files\ufylos.db
C:\spoolerlogs
c:\spoolerlogs\spooler.xml
c:\windows\duwymohu.com
c:\windows\myjile.com
c:\windows\system32\kefuguhi.dll
c:\windows\system32\loseteni.dll
c:\windows\system32\luruwono.dll
c:\windows\system32\muzupera.dll
c:\windows\system32\rijiraza.dll
c:\windows\system32\venaniwi.dll
c:\windows\system32\yefanopa.dll
c:\windows\system32\zadisylup.com

.
((((((((((((((((((((((((( Files Created from 2009-08-08 to 2009-09-08 )))))))))))))))))))))))))))))))
.

2009-09-07 21:21 . 2009-09-07 21:21 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-07 21:16 . 2009-09-07 21:16 -------- d-----w- c:\program files\AVG
2009-09-07 21:12 . 2009-09-07 21:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2009-09-07 21:06 . 2009-09-07 21:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-09-07 21:05 . 2009-09-07 21:05 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-09-07 02:47 . 2009-09-07 02:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-05 00:22 . 2009-09-05 00:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-04 03:53 . 2009-09-04 04:28 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-04 00:30 . 2009-09-04 00:30 -------- d-s---w- c:\documents and settings\Danny Everett\UserData
2009-09-03 21:32 . 2009-09-03 21:32 -------- d-----w- c:\windows\system32\Service
2009-09-03 21:29 . 2009-09-03 21:29 -------- d-----w- c:\program files\Alwil Software
2009-09-03 19:29 . 2009-09-03 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-03 19:27 . 2009-09-03 19:27 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\AVG8
2009-09-03 00:25 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-09-03 00:24 . 2009-09-03 00:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-03 00:23 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Adobe
2009-09-02 19:45 . 2009-09-02 19:45 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\Blitware
2009-09-02 16:53 . 2009-09-02 16:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DellUCM
2009-09-01 16:58 . 2008-04-14 07:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-09-01 16:58 . 2008-04-14 07:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-09-01 16:58 . 2008-10-07 18:20 1331200 ----a-w- c:\windows\system32\CNC330C.DLL
2009-09-01 16:58 . 2008-10-07 18:20 98304 ----a-w- c:\windows\system32\CNC330I.DLL
2009-09-01 16:58 . 2008-10-01 20:46 274432 ----a-w- c:\windows\system32\CNC330L.DLL
2009-09-01 16:58 . 2008-08-26 01:02 15872 ----a-w- c:\windows\system32\CNHMCA.DLL
2009-09-01 16:58 . 2008-07-16 16:39 192512 ----a-w- c:\windows\system32\CNC330O.DLL
2009-09-01 16:58 . 2008-04-14 07:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-09-01 16:58 . 2008-04-14 07:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-28 19:52 . 2009-08-28 19:52 -------- d-----w- c:\program files\Common Files\CANON
2009-08-28 19:48 . 2009-09-01 16:59 -------- d-----w- c:\program files\Canon
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\windows\Sun
2009-08-26 19:42 . 2009-08-26 19:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:32 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\DivX
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-08-24 20:47 . 2009-09-02 22:21 -------- d-----w- c:\program files\PokerStars
2009-08-22 18:39 . 2009-08-22 18:39 -------- d-----w- c:\windows\system32\LogFiles
2009-08-22 03:15 . 2006-10-27 02:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft Works
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft.NET
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\windows\SHELLNEW
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:08 -------- d-----r- C:\MSOCache
2009-08-22 03:05 . 2009-08-22 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-08 17:27 . 2009-06-18 00:30 0 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\WavXMapDrive.bat
2009-09-08 16:18 . 2009-06-08 16:18 88064 --sha-w- c:\windows\system32\wodezoga.dll
2009-09-08 07:58 . 2009-08-08 05:33 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\vlc
2009-09-04 23:30 . 2009-06-12 00:30 28824 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 23:12 . 2009-07-01 21:36 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\FrostWire
2009-09-04 22:35 . 2009-06-12 00:43 28824 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 19:52 . 2009-06-12 00:24 -------- d-----w- c:\program files\Intel
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\program files\CanonBJ
2009-08-08 05:32 . 2009-08-08 05:32 -------- d-----w- c:\program files\VideoLAN
2009-06-29 16:30 . 2009-06-12 06:58 256712 ----a-w- c:\windows\system32\PROUnstl.exe
2009-06-24 15:24 . 2009-06-24 15:24 184320 ----a-w- c:\windows\system32\Ncs2Setp.dll
2009-06-24 15:15 . 2009-06-24 15:15 764536 ----a-w- c:\windows\system32\ncs2dmix.dll
2009-06-24 15:15 . 2009-06-24 15:15 539256 ----a-w- c:\windows\system32\accesor.dll
2009-06-24 14:55 . 2009-06-24 14:55 141944 ----a-w- c:\windows\system32\ncs2instutility.dll
2009-06-24 14:46 . 2009-06-24 14:46 1620600 ----a-w- c:\windows\system32\ncscolib.dll
2009-06-24 07:54 . 2009-06-24 07:54 30880 ----a-w- c:\windows\system32\drivers\iqvw32.sys
2009-06-19 16:22 . 2009-06-19 16:22 0 ----a-w- c:\windows\nsreg.dat
2009-06-18 00:31 . 2009-06-12 00:00 43319 ----a-w- c:\windows\system32\nvModes.dat
2009-06-12 00:44 . 2009-06-18 00:30 12912 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 00:43 . 2009-06-12 00:43 0 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat
2009-06-12 00:11 . 2009-06-12 00:11 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-07_23.08.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-08 17:27 . 2009-09-08 17:27 16384 c:\windows\temp\Perflib_Perfdata_d08.dat
+ 2008-04-25 16:16 . 2009-09-08 17:18 79436 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2009-09-07 23:06 79436 c:\windows\system32\perfc009.dat
+ 2008-04-25 16:16 . 2009-09-08 17:18 464578 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2009-09-07 23:06 464578 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-22 200704]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-17 483420]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-03-17 729088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-28 13537280]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-28 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 136600]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-12-19 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-12-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2009-01-16 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2009-01-16 95544]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-01-19 667648]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2009-01-16 15360]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-06-12 2220032]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-03-01 1810432]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"nijajivey"="c:\windows\system32\wodezoga.dll" [2009-09-08 88064]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-08-28 1630208]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-08-28 90112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-2-6 1095456]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{fbd928ec-e10b-471d-b719-2f6f60639678}"= "c:\windows\system32\wodezoga.dll" [2009-09-08 88064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"givedibah"= {fbd928ec-e10b-471d-b719-2f6f60639678} - c:\windows\system32\wodezoga.dll [2009-09-08 88064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IDT\\WDM\\sttray.exe"=
"c:\\WINDOWS\\system32\\WLTRAY.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=

R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 3:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [12/29/2008 9:07 AM 320800]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [1/22/2009 8:19 AM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [1/22/2009 8:19 AM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2/6/2009 6:06 PM 443168]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [3/1/2009 4:09 PM 77824]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [6/11/2009 7:52 PM 112512]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [6/11/2009 7:52 PM 32808]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [6/11/2009 7:52 PM 239760]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [6/11/2009 5:36 PM 232744]
S2 gupdate1ca268228fa8f56;Google Update Service (gupdate1ca268228fa8f56);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 12:19 PM 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [4/19/2007 3:28 AM 42832]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys --> c:\windows\system32\Drivers\NvtSp50.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-09-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]

2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0e039e2b-6210-4da4-901d-85a89427dede} - c:\windows\system32\loseteni.dll
HKLM-Run-deyisefaza - c:\windows\system32\rijiraza.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Danny Everett\Application Data\Mozilla\Firefox\Profiles\4kii7g6s.default\
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-08 10:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(940)
c:\windows\System32\TdmNetworkProvider.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\wvauth.dll

- - - - - - - > 'explorer.exe'(1640)
c:\windows\system32\wodezoga.dll
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\drivers\audio\R213367\stacsv.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\hidfind.exe
c:\program files\DellTPad\ApntEx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\windows\system32\searchindexer.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\searchfilterhost.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-08 10:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-08 17:30
ComboFix2.txt 2009-09-07 23:10

Pre-Run: 116,784,590,848 bytes free
Post-Run: 116,745,834,496 bytes free

327 --- E O F --- 2009-09-03 20:00

EDIT: The file you asked me to submit was successfully submitted

Dannyeverett101 · 09-08-2009, 03:59 PM

This post will have the ESET scan attached. The computer seems to be running smoothly but im still getting "imposter" pop-ups for virus scanners that they try to get me to download. One of the main one i get is one that says someone would like to start a live chat with me, and it gives you two buttons saying "OK" and "Cancel". But when you read it, it says to exit you must press OK and to chat you must press Cancel. I can clearly see this is a scam...im just letting you know whats still going on...but i havent gotten one of those since the combofix scan along with that text file (when i dragged it on top of combofix) so maybe it was fixed but ill let you know if it occurs again

mas_pogi · 09-08-2009, 07:23 PM

hi.

Quote:

The file you asked me to submit was successfully submitted

Thank you.

Unfortunately, I can see a newly created malicious file. Lets get it. Please read my instruction first before your proceed.

Lets install your AVG first.

Get your copy here. http://free.avg.com/download?prd=afe

Then install it. It may ask you to reboot.

Then continue with instruction below.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

--------------------------------------------------------------------------
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. You can find instructions HERE.

AVG 8.5
Please open the AVG 8.5 Control Center, by right clicking on the AVG icon on task bar.

Click on Open AVG Interface.
Double click on Resident Shield
Deselect the option to "Enable Resident Shield."
Save changes, and exit the application.
To re-enable AVG 8.5 later, please select "Enable Resident Shield" again.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/411166-problem-computer.html#post2333722

FOLDER::
c:\program files\Alwil Software
COLLECT::
c:\windows\system32\wodezoga.dll
REGISTRY::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nijajivey"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=""

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

*note
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

Mark

Dannyeverett101 · 09-08-2009, 09:19 PM

Here you go.

ComboFix 09-09-08.01 - Danny Everett 09/08/2009 20:13.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1433 [GMT -7:00]
Running from: c:\documents and settings\Danny Everett\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Danny Everett\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Alwil Software
c:\program files\Alwil Software\Avast4\DATA\log\Warning.log
c:\program files\Alwil Software\Avast4\DATA\spool\suspic\{A1FEEF2D-1D0E-4438-8AF8-D3B84D0FF004}.suspic
c:\program files\Alwil Software\Avast4\Setup\setup.ini

.
((((((((((((((((((((((((( Files Created from 2009-08-09 to 2009-09-09 )))))))))))))))))))))))))))))))
.

2009-09-09 03:10 . 2009-09-09 03:10 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\AVG Security Toolbar
2009-09-09 03:04 . 2009-09-09 03:05 -------- d-----w- C:\$AVG8.VAULT$
2009-09-09 02:58 . 2009-09-09 02:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-09 02:58 . 2009-09-09 02:58 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-09-09 02:58 . 2009-09-09 02:58 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-09 02:58 . 2009-09-09 02:58 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-09 02:58 . 2009-09-09 02:58 -------- d-----w- c:\windows\system32\drivers\Avg
2009-09-09 02:58 . 2009-09-09 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-09-08 19:16 . 2009-09-08 19:16 -------- d-----w- c:\program files\ESET
2009-09-07 21:21 . 2009-09-07 21:21 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-09-07 21:16 . 2009-09-07 21:16 -------- d-----w- c:\program files\AVG
2009-09-07 21:12 . 2009-09-07 21:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Search
2009-09-07 21:06 . 2009-09-07 21:06 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-09-07 21:05 . 2009-09-07 21:05 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-09-07 02:47 . 2009-09-07 02:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-05 00:22 . 2009-09-05 00:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-04 03:53 . 2009-09-04 04:28 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-09-03 21:32 . 2009-09-03 21:32 -------- d-----w- c:\windows\system32\Service
2009-09-03 19:29 . 2009-09-09 03:09 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-03 19:27 . 2009-09-03 19:27 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\AVG8
2009-09-03 00:25 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-09-03 00:24 . 2009-09-03 00:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-03 00:23 . 2009-09-03 00:25 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Adobe
2009-09-02 19:45 . 2009-09-02 19:45 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\Blitware
2009-09-02 16:53 . 2009-09-02 16:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DellUCM
2009-09-01 16:58 . 2008-04-14 07:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-09-01 16:58 . 2008-04-14 07:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-09-01 16:58 . 2008-10-07 18:20 1331200 ----a-w- c:\windows\system32\CNC330C.DLL
2009-09-01 16:58 . 2008-10-07 18:20 98304 ----a-w- c:\windows\system32\CNC330I.DLL
2009-09-01 16:58 . 2008-10-01 20:46 274432 ----a-w- c:\windows\system32\CNC330L.DLL
2009-09-01 16:58 . 2008-08-26 01:02 15872 ----a-w- c:\windows\system32\CNHMCA.DLL
2009-09-01 16:58 . 2008-07-16 16:39 192512 ----a-w- c:\windows\system32\CNC330O.DLL
2009-09-01 16:58 . 2008-04-14 07:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-09-01 16:58 . 2008-04-14 07:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-28 19:52 . 2009-08-28 19:52 -------- d-----w- c:\program files\Common Files\CANON
2009-08-28 19:48 . 2009-09-01 16:59 -------- d-----w- c:\program files\Canon
2009-08-28 00:27 . 2009-08-28 00:27 -------- d-----w- c:\windows\Sun
2009-08-26 19:42 . 2009-08-26 19:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:32 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Google
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\DivX
2009-08-26 19:19 . 2009-08-26 19:25 -------- d-----w- c:\program files\Google
2009-08-26 19:19 . 2009-08-26 19:19 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-08-24 20:47 . 2009-09-02 22:21 -------- d-----w- c:\program files\PokerStars
2009-08-22 18:39 . 2009-08-22 18:39 -------- d-----w- c:\windows\system32\LogFiles
2009-08-22 03:15 . 2006-10-27 02:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft Works
2009-08-22 03:14 . 2009-08-22 03:14 -------- d-----w- c:\program files\Microsoft.NET
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\windows\SHELLNEW
2009-08-22 03:09 . 2009-08-22 03:09 -------- d-----w- c:\documents and settings\Danny Everett\Local Settings\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-22 03:08 . 2009-08-22 03:08 -------- d-----r- C:\MSOCache
2009-08-22 03:05 . 2009-08-22 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-09 03:08 . 2009-06-18 00:30 0 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\WavXMapDrive.bat
2009-09-08 19:15 . 2009-07-01 21:35 -------- d-----w- c:\program files\AskBarDis
2009-09-08 19:14 . 2009-06-12 00:10 -------- d-----w- c:\program files\Java
2009-09-08 07:58 . 2009-08-08 05:33 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\vlc
2009-09-04 23:30 . 2009-06-12 00:30 28824 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-04 23:12 . 2009-07-01 21:36 -------- d-----w- c:\documents and settings\Danny Everett\Application Data\FrostWire
2009-09-04 22:35 . 2009-06-12 00:43 28824 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 19:52 . 2009-06-12 00:24 -------- d-----w- c:\program files\Intel
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2009-08-28 19:49 . 2009-08-28 19:49 -------- d--h--w- c:\program files\CanonBJ
2009-08-08 05:32 . 2009-08-08 05:32 -------- d-----w- c:\program files\VideoLAN
2009-07-25 12:23 . 2009-06-12 00:11 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-06-29 16:30 . 2009-06-12 06:58 256712 ----a-w- c:\windows\system32\PROUnstl.exe
2009-06-24 15:24 . 2009-06-24 15:24 184320 ----a-w- c:\windows\system32\Ncs2Setp.dll
2009-06-24 15:15 . 2009-06-24 15:15 764536 ----a-w- c:\windows\system32\ncs2dmix.dll
2009-06-24 15:15 . 2009-06-24 15:15 539256 ----a-w- c:\windows\system32\accesor.dll
2009-06-24 14:55 . 2009-06-24 14:55 141944 ----a-w- c:\windows\system32\ncs2instutility.dll
2009-06-24 14:46 . 2009-06-24 14:46 1620600 ----a-w- c:\windows\system32\ncscolib.dll
2009-06-24 07:54 . 2009-06-24 07:54 30880 ----a-w- c:\windows\system32\drivers\iqvw32.sys
2009-06-19 16:22 . 2009-06-19 16:22 0 ----a-w- c:\windows\nsreg.dat
2009-06-18 00:31 . 2009-06-12 00:00 43319 ----a-w- c:\windows\system32\nvModes.dat
2009-06-12 00:44 . 2009-06-18 00:30 12912 ----a-w- c:\documents and settings\Danny Everett\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-12 00:43 . 2009-06-12 00:43 0 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-07_23.08.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-25 16:16 . 2009-09-09 03:14 79436 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2009-09-07 23:06 79436 c:\windows\system32\perfc009.dat
+ 2008-04-25 16:16 . 2009-09-09 03:14 464578 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2009-09-07 23:06 464578 c:\windows\system32\perfh009.dat
+ 2009-09-08 19:14 . 2009-07-25 12:23 149280 c:\windows\system32\javaws.exe
+ 2009-09-08 19:14 . 2009-07-25 12:23 145184 c:\windows\system32\javaw.exe
+ 2009-09-08 19:14 . 2009-07-25 12:23 145184 c:\windows\system32\java.exe
+ 2009-06-18 00:30 . 2009-09-08 19:14 262144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
- 2009-06-18 00:30 . 2009-06-12 00:44 262144 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 16:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-01-14 15:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-22 200704]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-17 483420]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-03-17 729088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-28 13537280]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-28 86016]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-12-19 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-12-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2009-01-16 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2009-01-16 95544]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-01-19 667648]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2009-01-16 15360]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-06-12 2220032]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2009-03-01 1810432]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-09 2007832]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-08-28 1630208]
"NVHotkey"="nvHotkey.dll" - c:\windows\system32\nvhotkey.dll [2008-08-28 90112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-2-6 1095456]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-09 02:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IDT\\WDM\\sttray.exe"=
"c:\\WINDOWS\\system32\\WLTRAY.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/8/2009 7:58 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/8/2009 7:58 PM 108552]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 3:56 AM 133968]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [9/8/2009 7:58 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/8/2009 7:58 PM 297752]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [12/29/2008 9:07 AM 320800]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [1/22/2009 8:19 AM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [1/22/2009 8:19 AM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2/6/2009 6:06 PM 443168]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [3/1/2009 4:09 PM 77824]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [6/11/2009 7:52 PM 112512]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [6/11/2009 7:52 PM 32808]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [6/11/2009 7:52 PM 239760]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\SRS_PremiumSound_i386.sys [6/11/2009 5:36 PM 232744]
S2 gupdate1ca268228fa8f56;Google Update Service (gupdate1ca268228fa8f56);c:\program files\Google\Update\GoogleUpdate.exe [8/26/2009 12:19 PM 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [4/19/2007 3:28 AM 42832]
S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys --> c:\windows\system32\Drivers\NvtSp50.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-09-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]

2009-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-26 19:19]
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{fbd928ec-e10b-471d-b719-2f6f60639678} - c:\windows\system32\wodezoga.dll
SSODL-givedibah-{fbd928ec-e10b-471d-b719-2f6f60639678} - c:\windows\system32\wodezoga.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\Danny Everett\Application Data\Mozilla\Firefox\Profiles\4kii7g6s.default\
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-08 20:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(948)
c:\windows\System32\TdmNetworkProvider.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(1004)
c:\windows\system32\wvauth.dll
.
Completion time: 2009-09-09 20:18
ComboFix-quarantined-files.txt 2009-09-09 03:17
ComboFix2.txt 2009-09-08 17:30
ComboFix3.txt 2009-09-07 23:10

Pre-Run: 116,231,884,800 bytes free
Post-Run: 116,392,173,568 bytes free

257 --- E O F --- 2009-09-03 20:00

mas_pogi · 09-08-2009, 09:29 PM

hi.

How's your computer now?

Did you proceed with AVG scanning? Did it caught some malwares?

Mark

Dannyeverett101 · 09-08-2009, 09:44 PM

No i didnt see you put in the instructions to scan with AVG

i will do that now

mas_pogi · 09-08-2009, 09:46 PM

hi.

No need.

Quote:

How's your computer now?

Answer this one.

Mark

Dannyeverett101 · 09-08-2009, 09:55 PM

i had already started the scan, it is in progress...

it has found a bunch of things, they are all "Tracking cookies"

The computer is running great, no signs of any malware

mas_pogi · 09-08-2009, 10:04 PM

hi.

Those cookies are usually came from the site you visited. Just delete them.

After you're done with your AVG scanning, please continue with housekeeping instruction.

Congratulations! You now appear clean!

We Need to Clean Up Our Mess

Uninstall ComboFix
Remove Combofix now that we're done with it.
- Click on your Start Menu, then Run....
- Now copy and paste this one in the runbox. Then HIT enter.
  Code:
```
ComboFix /u
```
Uninstalling ComboFix will do the following:
1. Delete ComboFix and its components from your computer.
2. Delete other tools commonly used during the malware removal process.
3. Resets clock settings to standard format.
4. Re-hides file extensions and hidden/system files.
5. Clears System Restore cache and creates new restore point.
Please also delete the DDS.scr located at your desktop.

-----------------------------------------------
Recommendations
Below are some recommendations to lower your chances of (re)infection.

Install Spyware Blaster and update it regularly
If you wish, the commercial version provides automatic updating.
Install the MVPs hosts file, and update it regularly
You can use the HostMan host file manager to do this automaticly if you wish.
For more information on the hosts file, and what it can do for you, you can view the Tutorial on the Hosts file
Install an Anti-Spyware program, and update it regularly
Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
SUPERAntiSpyware is another good scanner with high detection and removal rates.
Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
Keep Windows (and your other Microsoft software) up to date!
I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
Keep your other software up to date as well
Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on your machine.
Stay up to date!
The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing :(.

Don't forget to enable all your security applications.
Please respond to this thread one more time so we can mark this thread as resolved.

Mark

09-04-2009, 06:47 PM	#2 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. If you are having a hard time wth Gmer, try this one. Download RootRepeal.zip to your Desktop and extract the compressed file to it's own folder. Open the folder and doubleclick on RootRepeal.exe to run it. Click on the Report tab, and then click on: Scan A window opens asking what to include in the scan. Check the following boxes then click OK: Drivers Files Processes SSDT Stealth Objects Hidden Services Shadow SSDT You will then be asked which drive to scan. Check C: (or the drive your operating system is installed on, if not C) Click OK once again. The tool will begin scanning and may take a while to complete, so please be patient. When the scan finishes, click on: Save Report. Save it to your desktop so you may find it easily. Please attach the report in your next reply. Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P

09-05-2009, 03:38 PM	#3 (permalink)
Dannyeverett101 Registered User Join Date: Sep 2009 Posts: 27 OS: Win XP Pro	Re: Problem with computer New problem: When i start my computer it boots up normally with my normal background, but then when a program tries to autostart on my toolbar, a cloud comes up saying "Total security warning" and then tries to scan, I see that this is a scam trying to insert more viruses. The background is writing that tells me "Warning. Your in danger. Your computer is infected with spyware." It has a bunch of other writing below that about how [people like my "brother, sister parents, boss, can see my archived information" It does let me start any programs or anything, so i cannot download that rootkit scanner to my computer anymore, how can i do this?

09-05-2009, 07:41 PM	#4 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. Try rebooting into Safe Mode with Networking. This can be done tapping the F8 key as soon as you start your computer You will be brought to a menu where you can choose to boot into safe mode with networking. Then start from there. Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P

09-07-2009, 04:04 AM	#6 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. Your system is really infected. Please bear with me. You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe ------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ----------------------------------------------------------------------- I am sorry to inform you that one or more of the identified infections is a backdoor trojan. This allows hackers to remotely control your computer, steal critical system information and download and execute files. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? ---------------------------------------------------------------------- Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. -------------------------------------------------------------------------- Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. Link 1 Link 2 Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. You can find instructions HERE. AVG 8.5 Please open the AVG 8.5 Control Center, by right clicking on the AVG icon on task bar. Click on Open AVG Interface. Double click on Resident Shield Deselect the option to "Enable Resident Shield." Save changes, and exit the application. To re-enable AVG 8.5 later, please select "Enable Resident Shield" again. Double click on Combo-Fix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** in your next reply. *re-enable all your security application after the fix. Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P

09-07-2009, 03:20 PM	#7 (permalink)
Dannyeverett101 Registered User Join Date: Sep 2009 Posts: 27 OS: Win XP Pro	Re: Problem with computer I am booting in safe mode and there is no icon for AVG on the tray, but it says AVG free is running when i try and use Combo-Fix i tried going to control panel, add and remove programs but AVG wasnt listed, then i searched for AVG files and found a folder called AVG and one called AVG8. I tried deleting them to get rid of AVG but it didnt work. How can i disable this?

09-07-2009, 04:34 PM	#8 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. Please continue running Combofix. And post the result here. Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P

09-08-2009, 10:53 AM	#11 (permalink)
Dannyeverett101 Registered User Join Date: Sep 2009 Posts: 27 OS: Win XP Pro	Re: Problem with computer EDIT: Made a mistake in this post and posted the previous combofix.txt, not the new one...the new one will be up shortly disregard the text i had in this post referring the Combofix.txt is you already read it before i removed it from the post I did download and run avast but eventually i removed it because it wasnt working properly...AVG wouldn't complete the install when i tried to install it. I tried both avast and AVG after my computer was already infected, not before. Here is the scan for the first file: CNC330L.DLL File CNC330L.DLL received on 2009.09.08 16:21:38 (UTC) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/41 (0%) Loading server information... Your file is queued in position: 1. Estimated start time is between 43 and 62 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.24 2009.09.08 - AhnLab-V3 5.0.0.2 2009.09.08 - AntiVir 7.9.1.12 2009.09.08 - Antiy-AVL 2.0.3.7 2009.09.08 - Authentium 5.1.2.4 2009.09.08 - Avast 4.8.1351.0 2009.09.08 - AVG 8.5.0.409 2009.09.08 - BitDefender 7.2 2009.09.08 - CAT-QuickHeal 10.00 2009.09.08 - ClamAV 0.94.1 2009.09.08 - Comodo 2204 2009.09.08 - DrWeb 5.0.0.12182 2009.09.08 - eSafe 7.0.17.0 2009.09.08 - eTrust-Vet 31.6.6725 2009.09.08 - F-Prot 4.5.1.85 2009.09.08 - F-Secure 8.0.14470.0 2009.09.08 - Fortinet 3.120.0.0 2009.09.08 - GData 19 2009.09.08 - Ikarus T3.1.1.72.0 2009.09.08 - Jiangmin 11.0.800 2009.09.08 - K7AntiVirus 7.10.839 2009.09.08 - Kaspersky 7.0.0.125 2009.09.08 - McAfee 5735 2009.09.08 - McAfee+Artemis 5735 2009.09.08 - McAfee-GW-Edition 6.8.5 2009.09.08 - Microsoft 1.5005 2009.09.08 - NOD32 4406 2009.09.08 - Norman 6.01.09 2009.09.08 - nProtect 2009.1.8.0 2009.09.08 - Panda 10.0.2.2 2009.09.07 - PCTools 4.4.2.0 2009.09.07 - Prevx 3.0 2009.09.08 - Rising 21.46.14.00 2009.09.08 - Sophos 4.45.0 2009.09.08 - Sunbelt 3.2.1858.2 2009.09.07 - Symantec 1.4.4.12 2009.09.08 - TheHacker 6.3.4.3.397 2009.09.07 - TrendMicro 8.950.0.1094 2009.09.08 - VBA32 3.12.10.10 2009.09.08 - ViRobot 2009.9.8.1923 2009.09.08 - VirusBuster 4.6.5.0 2009.09.08 - Additional information File size: 274432 bytes MD5...: a94af70a5c5cf313d42d5996663a21e6 SHA1..: a02167b7a0c5e4fee8ce9e6ca5bf009246577121 SHA256: 7c766ae019a0b05ae0527bb0415eccafcd81c3540f89b6180b43d28d9b95e5c4 ssdeep: 6144:XASPSzpjieA3UUBvBjiX60jlAOXEjgQZRIw0:LPSz23pvMVx9QcN PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1fa0f timedatestamp.....: 0x48e300b1 (Wed Oct 01 04:46:41 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x306de 0x31000 6.66 2e0b249da065c452c0af601e0a1f2a36 .rdata 0x32000 0x992d 0xa000 5.97 a6160fd7d3eda48f6a0ed7d98760436f .data 0x3c000 0x4180 0x3000 3.29 fd755f81b7d5f1ea9e273b322815b63e .rsrc 0x41000 0x3c4 0x1000 3.67 d62f5965f5272b18ad99871a6e2a12a2 .reloc 0x42000 0x2b12 0x3000 4.87 ff2031842ebc3c122489eae627e7c14b ( 4 imports ) > KERNEL32.dll: WaitForMultipleObjects, CreateThread, DeleteCriticalSection, InitializeCriticalSection, UnmapViewOfFile, MapViewOfFile, GetLastError, CreateFileMappingA, GetVersionExA, GetLocalTime, LeaveCriticalSection, EnterCriticalSection, CreateMutexA, ReleaseMutex, FormatMessageA, GetModuleFileNameA, GetModuleHandleA, FreeLibrary, ResetEvent, LoadLibraryA, WideCharToMultiByte, GetFileSize, CreateFileA, ExitThread, GetExitCodeThread, GetSystemDirectoryA, MultiByteToWideChar, HeapFree, HeapAlloc, GetProcessHeap, DeviceIoControl, WriteFile, ReadFile, GetOverlappedResult, SetEnvironmentVariableA, CompareStringW, CompareStringA, WriteConsoleW, GetConsoleOutputCP, CreateEventA, SetEvent, WaitForSingleObject, CloseHandle, GetTempPathA, GetPrivateProfileStringA, GetPrivateProfileIntA, GetProcAddress, Sleep, RtlUnwind, RaiseException, GetSystemTimeAsFileTime, GetTimeZoneInformation, GetCurrentThreadId, GetCommandLineA, VirtualFree, VirtualAlloc, HeapReAlloc, HeapDestroy, HeapCreate, ExitProcess, GetStdHandle, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, LCMapStringA, LCMapStringW, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, SetFilePointer, GetConsoleCP, GetConsoleMode, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers, WriteConsoleA, SetEndOfFile > USER32.dll: wsprintfA > WINSPOOL.DRV: EnumMonitorsA, EnumPortsA > ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegCloseKey, ImpersonateSelf, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RevertToSelf, RegOpenKeyA ( 29 exports ) _FindScannerEx_Network@@YGHPAPAXPBDG@Z, DoCalibration, FindScannerEx, GetAGData, GetCalibrationStatus, GetCanonAPIVersion, GetCropStatus, GetDataStatus, GetLampStatus, GetOPUMode, GetReadStatus, GetScannerAbilitySize, GetScannerAbilityXp, GetScannerStatus, InitialButton, InitializeScanner, LockScanner, ReadPushButton, ReadScan, SetAGData, SetErrorToDevice, SetGamma, SetLamp, SetScanParameter, StartScanEx, StopScanEx, TerminateScanner, TestScanner, UnlockScanner RDS...: NSRL Reference Data Set - pdfid.: - trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) Here is the log for CNHMCA.DLL File CNHMCA.DLL received on 2009.09.08 16:52:25 (UTC) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/41 (0%) Loading server information... Your file is queued in position: 2. Estimated start time is between 52 and 75 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.24 2009.09.08 - AhnLab-V3 5.0.0.2 2009.09.08 - AntiVir 7.9.1.12 2009.09.08 - Antiy-AVL 2.0.3.7 2009.09.08 - Authentium 5.1.2.4 2009.09.08 - Avast 4.8.1351.0 2009.09.08 - AVG 8.5.0.409 2009.09.08 - BitDefender 7.2 2009.09.08 - CAT-QuickHeal 10.00 2009.09.08 - ClamAV 0.94.1 2009.09.08 - Comodo 2204 2009.09.08 - DrWeb 5.0.0.12182 2009.09.08 - eSafe 7.0.17.0 2009.09.08 - eTrust-Vet 31.6.6725 2009.09.08 - F-Prot 4.5.1.85 2009.09.08 - F-Secure 8.0.14470.0 2009.09.08 - Fortinet 3.120.0.0 2009.09.08 - GData 19 2009.09.08 - Ikarus T3.1.1.72.0 2009.09.08 - Jiangmin 11.0.800 2009.09.08 - K7AntiVirus 7.10.839 2009.09.08 - Kaspersky 7.0.0.125 2009.09.08 - McAfee 5735 2009.09.08 - McAfee+Artemis 5735 2009.09.08 - McAfee-GW-Edition 6.8.5 2009.09.08 - Microsoft 1.5005 2009.09.08 - NOD32 4407 2009.09.08 - Norman 6.01.09 2009.09.08 - nProtect 2009.1.8.0 2009.09.08 - Panda 10.0.2.2 2009.09.08 - PCTools 4.4.2.0 2009.09.07 - Prevx 3.0 2009.09.08 - Rising 21.46.14.00 2009.09.08 - Sophos 4.45.0 2009.09.08 - Sunbelt 3.2.1858.2 2009.09.07 - Symantec 1.4.4.12 2009.09.08 - TheHacker 6.3.4.3.397 2009.09.07 - TrendMicro 8.950.0.1094 2009.09.08 - VBA32 3.12.10.10 2009.09.08 - ViRobot 2009.9.8.1923 2009.09.08 - VirusBuster 4.6.5.0 2009.09.08 - Additional information File size: 15872 bytes MD5...: d16cf34b17899f90a8fcf2a3f77b4a27 SHA1..: 04859b5ff64adb10b066c64900d6c6020863d1f1 SHA256: 131f14b234f08e7c9e1bb30836f2459ce7cf468b6968e9b161982d3b52e77e21 ssdeep: 384:z0n63Suk/MSnK4/rQHP0KJTdSO48ISCLsfrT:zH3luMeK4cHMKv3GYf3 PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x23e6 timedatestamp.....: 0x48b27523 (Mon Aug 25 09:02:27 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x30cf 0x3200 6.46 d81107d765c68f6f4c709802fab5f601 .data 0x5000 0x32c 0x200 0.18 f82d0414c3e3ade164d998c76d9eaef7 .rsrc 0x6000 0x3f8 0x400 3.28 957d8f58c63f145146965f216ebb6cbc .reloc 0x7000 0x106 0x200 1.93 6ad735d350034c82d4a76764e0b41590 ( 1 imports ) > KERNEL32.dll: DisableThreadLibraryCalls, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GlobalAlloc, GlobalFree, CloseHandle, ReadFile, SetFilePointer, CreateFileW, MultiByteToWideChar ( 6 exports ) CSFreeTable, CSGetCategoryInfoS, CSGetCategoryInfoV, CSGetMainInfo, CSGetTable, CSGetTableFormatType RDS...: NSRL Reference Data Set - pdfid.: - trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) Other instructions coming in next post because i must close my browser now to do the combofix instructions Last edited by Dannyeverett101; 09-08-2009 at 10:57 AM.

09-08-2009, 09:29 PM	#16 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. How's your computer now? Did you proceed with AVG scanning? Did it caught some malwares? Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P

09-08-2009, 09:44 PM	#17 (permalink)
Dannyeverett101 Registered User Join Date: Sep 2009 Posts: 27 OS: Win XP Pro	Re: Problem with computer No i didnt see you put in the instructions to scan with AVG i will do that now

09-08-2009, 09:55 PM	#19 (permalink)
Dannyeverett101 Registered User Join Date: Sep 2009 Posts: 27 OS: Win XP Pro	Re: Problem with computer i had already started the scan, it is in progress... it has found a bunch of things, they are all "Tracking cookies" The computer is running great, no signs of any malware

09-08-2009, 10:04 PM	#20 (permalink)
mas_pogi Analyst, Security Team Join Date: Apr 2008 Location: Tokyo, JP Posts: 1,476 OS: Vista, Linux Mint	Re: Problem with computer hi. Those cookies are usually came from the site you visited. Just delete them. After you're done with your AVG scanning, please continue with housekeeping instruction. Congratulations! You now appear clean! We Need to Clean Up Our Mess Uninstall ComboFix Remove Combofix now that we're done with it. Click on your Start Menu, then Run.... Now copy and paste this one in the runbox. Then HIT enter. Code: ComboFix /u Uninstalling ComboFix will do the following: Delete ComboFix and its components from your computer. Delete other tools commonly used during the malware removal process. Resets clock settings to standard format. Re-hides file extensions and hidden/system files. Clears System Restore cache and creates new restore point. Please also delete the DDS.scr located at your desktop. ----------------------------------------------- Recommendations Below are some recommendations to lower your chances of (re)infection. Install Spyware Blaster and update it regularly If you wish, the commercial version provides automatic updating. Install the MVPs hosts file, and update it regularly You can use the HostMan host file manager to do this automaticly if you wish. For more information on the hosts file, and what it can do for you, you can view the Tutorial on the Hosts file Install an Anti-Spyware program, and update it regularly Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates. SUPERAntiSpyware is another good scanner with high detection and removal rates. Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions. Keep Windows (and your other Microsoft software) up to date! I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer. Visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!! Keep your other software up to date as well Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on your machine. Stay up to date! The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing :(. Don't forget to enable all your security applications. Please respond to this thread one more time so we can mark this thread as resolved. Mark __________________ To accomplish great things, we must not only act, but also dream; not only plan, but also believe. If I have been helping you and do not reply within 24 hours, please send me a message. I'm a member of U.N.I.T.E and A.S.A.P