Another Google Hijack

Dell / Dell dm051...
January 2, 2009 at 07:08:02
Specs: Microsoft Windows XP Home Edition, 2.793 GHz / 510 MB
Yet another Google search hijack. Doesn't happen every time, though. Clicking on a search result sometimes is redirected to a shopzilla, shopica, etc. type site.

Downloaded and ran both Malwarebytes and Hijack This. Logs available for posting upon request.

Thanks in advance for your help!

CJ

edited by moderator


See More: Another Google Hijack

Report •


#1
January 2, 2009 at 10:40:45
Please post your logs.

Report •

#2
January 2, 2009 at 16:20:44
hmmm. . .these were in my first post. . .

but anyway -

Malwarebytes' Anti-Malware 1.31
Database version: 1596
Windows 5.1.2600 Service Pack 3

1/2/2009 9:54:19 AM
mbam-log-2009-01-02 (09-54-19).txt

Scan type: Full Scan (C:\|)
Objects scanned: 153693
Time elapsed: 1 hour(s), 5 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:01 AM, on 1/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Documents and Settings\All Users\Documents\Yodm3D\Yod'm 3D\Yodm3D.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\All Users\Documents\Yodm3D\Yod'm 3D\Yodm3D.exe
O4 - HKUS\S-1-5-21-2389133853-2261179895-4079814988-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Christina Meinke')
O4 - HKUS\S-1-5-21-2389133853-2261179895-4079814988-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Christina Meinke')
O4 - HKUS\S-1-5-21-2389133853-2261179895-4079814988-1006\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler (User 'Christina Meinke')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/s...
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 10295 bytes


Report •

#3
January 2, 2009 at 18:09:14
I don't see an antivirus program running, you must install one before we continue.

To get the free version of AVG antivirus, you can download it at this link:
AVG Free Antivirus

Update it once you get it installed.

We will need to diable it on some of the scans, to do so right click the icon in the systray (bottom right of your screen)> then click exit. You have to restart the computer to get it running again.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

Related Solutions

#4
January 2, 2009 at 19:37:46
ComboFix 09-01-01.02 - Chris Joyce 2009-01-02 22:15:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.189 [GMT -5:00]
Running from: c:\documents and settings\Chris Joyce\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.

2009-01-02 22:08 . 2009-01-02 22:08 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-02 21:40 . 2009-01-02 21:40 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-02 21:40 . 2009-01-02 21:40 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-01-02 21:40 . 2009-01-02 21:40 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-02 21:39 . 2009-01-02 21:44 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-02 21:39 . 2009-01-02 21:39 <DIR> d-------- c:\program files\AVG
2009-01-02 21:39 . 2009-01-02 21:39 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\AVGTOOLBAR
2009-01-02 21:39 . 2009-01-02 21:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\Malwarebytes
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-02 08:47 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-02 08:47 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-01 15:10 . 2009-01-01 15:10 <DIR> d-------- c:\program files\Trend Micro
2008-12-22 12:25 . 2008-12-22 12:25 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-09 08:13 . 2008-12-29 10:50 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-09 08:13 . 2008-12-29 09:04 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\SUPERAntiSpyware.com
2008-12-09 08:13 . 2008-12-09 08:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-04 15:47 . 2008-12-04 15:47 39,936 --a------ c:\windows\Bcufunuhog.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 03:05 --------- d-----w c:\program files\Google
2009-01-02 16:54 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-22 17:25 --------- d-----w c:\program files\Java
2008-12-09 02:13 --------- d-----w c:\program files\Common Files\Adobe
2008-11-24 14:41 253,952 ----a-w c:\windows\evefimifetelag.dll
2008-11-21 20:55 --------- d-----w c:\program files\RocketDock
2006-08-26 12:06 56 --sh--r c:\windows\system32\DEC86EC0EA.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2007-08-30 205480]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Yodm3D"="c:\documents and settings\All Users\Documents\Yodm3D\Yod'm 3D\Yodm3D.exe" [2007-04-21 2343936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2007-08-28 73728]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-18 110592]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-18 8192]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2007-08-30 205480]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-04 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-22 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-02 1261336]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-01 24576]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2009-01-02 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-02 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-02 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2009-01-02 76040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-10-27 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{22909439-71f3-11dd-afaa-00038a000015}]
\Shell\AutoRun\command - I:\laucher.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)


.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: online.musicmatch.com
FF - ProfilePath - c:\documents and settings\Chris Joyce\Application Data\Mozilla\Firefox\Profiles\4ud47q0v.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl<mpl=yj_wsad<mplcache=2
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 22:26:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\Ati2evxx.dll
.
r Running Proce
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\MUSICM~1\MUSICM~3\MMDiag.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\system32\wscntfy.exe
c:\program files\MUSICMATCH\Musicmatch Jukebox\mim.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-01-02 22:31:04 - machine was rebooted [Chris Joyce]
ComboFix-quarantined-files.txt 2009-01-03 03:30:59

Pre-Run: 56,321,138,688 bytes free
Post-Run: 57,749,606,400 bytes free

161 --- E O F --- 2008-12-21 13:26:39


Report •

#5
January 2, 2009 at 20:03:37
Please go to Virus Total and upload the following files one at the time for analysis:

c:\windows\Bcufunuhog.dat

c:\windows\evefimifetelag.dll

c:\windows\system32\DEC86EC0EA.sys

Use the browse button at the site to find the file, once you find the file double click it and it should appear in the empty space to the left of the browse button> click "send file".

Post the results in your reply.

Once you get SDFix downloaded go offline, turn off your AVG antivirus, and turn off any antispyware that you have, run SDFix from safe mode and restart the Antivirus before you get back on line to post the log.

Download SDFix.exe and save it to your Desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re-enable the protection again afterwards before connecting to the Internet.

1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
2. Open the c:\SDFix folder and double click RunThis.cmd to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
3. Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt


Report •

#6
January 2, 2009 at 23:13:27
File Bcufunuhog.dat received on 01.03.2009 08:01:30 (CET)
Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 Trojan.Win32.Hiloti!IK
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6289 2009.01.02 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 Trojan.Win32.Hiloti
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.02 Trojan:Win32/Hiloti.gen!A
NOD32 3733 2009.01.02 a variant of Win32/Cimag
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 -
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -
Additional information
File size: 39936 bytes
MD5...: 4a42b65ea485278ffd50aa9159dcae83
SHA1..: b0a1c9f85069798e669a23dc3dde22691787e5f6
SHA256: 12bd1db37d8d4db4d67b85b3b3bb7de9836903f0d31e931312200b7fe5b22606
SHA512: 9a9e5dccc7aa86cea384c5b31ea0a6cdc2415c1dc0dc0745d948d937a2f3bbf3
1d435ce05b621fe55267cfc6a5cb665608415c2d8ebbc14813b165695aaa8fd7

ssdeep: 768:2AwUSG+KPx4IyyJGrjWsgN69hm3kL8JS9hYb1hVOmsi257:2A6G+fusgNO1y
SPkTX2F

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10005fa0
timedatestamp.....: 0x4869bf75 (Tue Jul 01 05:24:05 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x7000 0x6a00 7.60 1aea07ad87b9e62c6fde82d6c0b58006
.data 0x8000 0x2000 0x1a00 6.22 418011d944923d03018b0f5040314327
.rsrc 0xa000 0x1000 0x600 2.71 8a5de5af091397fb09ad8b485669e8a8
.reloc 0xb000 0x1000 0x200 2.24 3f3ca94f6731cf09e62f7aeefeb71767

( 5 imports )
> KERNEL32.dll: EnterCriticalSection, FreeLibrary, GetEnvironmentStringsA, GetFileType, GetSystemDirectoryA, GetSystemTimeAsFileTime, HeapAlloc, HeapCreate, OpenProcess, SetEnvironmentVariableA, lstrcmpA, lstrcpynA, lstrlenA
> msvcrt.dll: __p__fmode, wcslen, malloc
> user32.dll: GetSystemMetrics, PtInRect, SetCapture, GetUserObjectSecurity, PostMessageA, GetWindowThreadProcessId
> OLEAUT32.dll: -, -, -, -, -, -
> SHLWAPI.dll: PathBuildRootA, PathFileExistsA, SHDeleteEmptyKeyA, SHSetValueA, StrStrA, StrToIntA, PathAppendA

( 0 exports )

Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 Trojan.Win32.Hiloti!IK
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6289 2009.01.02 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 Trojan.Win32.Hiloti
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.02 Trojan:Win32/Hiloti.gen!A
NOD32 3733 2009.01.02 a variant of Win32/Cimag
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 -
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -

Additional information
File size: 39936 bytes
MD5...: 4a42b65ea485278ffd50aa9159dcae83
SHA1..: b0a1c9f85069798e669a23dc3dde22691787e5f6
SHA256: 12bd1db37d8d4db4d67b85b3b3bb7de9836903f0d31e931312200b7fe5b22606
SHA512: 9a9e5dccc7aa86cea384c5b31ea0a6cdc2415c1dc0dc0745d948d937a2f3bbf3
1d435ce05b621fe55267cfc6a5cb665608415c2d8ebbc14813b165695aaa8fd7

ssdeep: 768:2AwUSG+KPx4IyyJGrjWsgN69hm3kL8JS9hYb1hVOmsi257:2A6G+fusgNO1y
SPkTX2F

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10005fa0
timedatestamp.....: 0x4869bf75 (Tue Jul 01 05:24:05 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x7000 0x6a00 7.60 1aea07ad87b9e62c6fde82d6c0b58006
.data 0x8000 0x2000 0x1a00 6.22 418011d944923d03018b0f5040314327
.rsrc 0xa000 0x1000 0x600 2.71 8a5de5af091397fb09ad8b485669e8a8
.reloc 0xb000 0x1000 0x200 2.24 3f3ca94f6731cf09e62f7aeefeb71767

( 5 imports )
> KERNEL32.dll: EnterCriticalSection, FreeLibrary, GetEnvironmentStringsA, GetFileType, GetSystemDirectoryA, GetSystemTimeAsFileTime, HeapAlloc, HeapCreate, OpenProcess, SetEnvironmentVariableA, lstrcmpA, lstrcpynA, lstrlenA
> msvcrt.dll: __p__fmode, wcslen, malloc
> user32.dll: GetSystemMetrics, PtInRect, SetCapture, GetUserObjectSecurity, PostMessageA, GetWindowThreadProcessId
> OLEAUT32.dll: -, -, -, -, -, -
> SHLWAPI.dll: PathBuildRootA, PathFileExistsA, SHDeleteEmptyKeyA, SHSetValueA, StrStrA, StrToIntA, PathAppendA

( 0 exports )

File evefimifetelag.dll received on 01.03.2009 08:05:31 (CET)
Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 -
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6287 2009.01.01 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 -
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.03 -
NOD32 3733 2009.01.02 -
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 Fraudulent Security Program
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 Troj/BHO-IQ
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -
Additional information
File size: 253952 bytes
MD5...: 8247f8977ee9bda5a48753b0346d6b5c
SHA1..: 8edf5602625688a8c7fc8e4ef63b2dcd58c1a953
SHA256: 4468aae5e3f2a980c8e5d47733e8a723f1d1e03db4d25d337ffda906f19b78ec
SHA512: a223490bb3b4018e6a1a8f8ebd90f43f3dd46b5fd6ae710e0f56af06f4035c9a
d62fd0af4979110d31c4895c8d47988b81d898ca336370fd588a59be25760acb

ssdeep: 3072:kFKga7hdf519gFmhzbqfSkkcjwwJLfWvGEDUKiAYBDQ3apSe9P32I0nFIOZ
tw71+:KKgON8mhzbqfSkcwJLfOjiNBE3aIU7

PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10017964
timedatestamp.....: 0x492888a2 (Sat Nov 22 22:33:06 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x25eca 0x26000 6.69 e29a5beac684bb7217baf606e8312762
.rdata 0x27000 0xd599 0xe000 5.55 86ceb84a817be9ec7067cedc633f1daf
.data 0x35000 0x8200 0x5000 3.45 0bb56d6b0e4707d486cb1ae960775874
.reloc 0x3e000 0x3476 0x4000 5.05 54bd37fa5af85aab3ffae0e351709675

( 8 imports )
> VERSION.dll: VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
> KERNEL32.dll: CreateProcessW, lstrcpyW, lstrcatW, SystemTimeToFileTime, WideCharToMultiByte, ReadFile, GetFileSize, SetFilePointer, CreateFileW, InterlockedDecrement, InterlockedIncrement, GetProcAddress, LoadLibraryW, GetModuleFileNameW, SetEvent, Sleep, ResetEvent, WaitForSingleObject, OpenEventW, CreateMutexW, EnterCriticalSection, LeaveCriticalSection, CreateEventW, SetWaitableTimer, CancelWaitableTimer, GetLastError, CreateWaitableTimerW, OpenWaitableTimerW, lstrcpynA, GetTickCount, MultiByteToWideChar, CreateThread, lstrlenA, RaiseException, InitializeCriticalSection, DeleteCriticalSection, FreeLibraryAndExitThread, OpenMutexW, DisableThreadLibraryCalls, GetVersionExW, CloseHandle, lstrcmpW, FreeLibrary, LocalFree, OpenProcess, LocalAlloc, SetEndOfFile, WriteFile, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetSystemTime, WaitForMultipleObjects, FlushFileBuffers, CreateDirectoryW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, lstrcpyA, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, SetHandleCount, GetModuleFileNameA, GetStdHandle, GetOEMCP, VirtualQuery, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, ExitProcess, HeapSize, GetLocalTime, lstrlenW, lstrcpynW, GetSystemWindowsDirectoryW, GetVolumeInformationW, GetCurrentProcessId, ReleaseMutex, SetLastError, TlsFree, TlsSetValue, GetLocaleInfoW, LoadLibraryA, IsValidCodePage, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, TlsAlloc, TlsGetValue, GetModuleHandleA, GetStringTypeW, GetStringTypeA, GetCPInfo, LCMapStringW, LCMapStringA, GetProcessHeap, GetCommandLineA, GetCurrentThreadId, HeapReAlloc, HeapAlloc, GetSystemTimeAsFileTime, HeapFree, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, RtlUnwind, InterlockedCompareExchange, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, InterlockedExchange
> USER32.dll: GetWindowModuleFileNameW, SetWindowsHookExW, PostMessageW, CallNextHookEx, LockSetForegroundWindow, UnregisterClassA, SetWindowTextW, EnumChildWindows, FindWindowExW, SendMessageW, UpdateWindow, IsCharAlphaNumericW, IsCharAlphaW, MsgWaitForMultipleObjects, PeekMessageW, TranslateMessage, DispatchMessageW, wsprintfW, SetWindowPos
> ADVAPI32.dll: RegEnumValueW, RegFlushKey, RegNotifyChangeKeyValue, RegCreateKeyExW, RegQueryValueExW, RegDeleteValueW, RegOpenKeyExW, RegSetValueExW, RegCloseKey
> SHELL32.dll: SHGetFolderPathW, -, SHCreateDirectoryExW
> ole32.dll: CoMarshalInterThreadInterfaceInStream, CoInitializeEx, CoTaskMemFree, CoUninitialize, CoCreateInstance, OleRun, StringFromCLSID, CoCreateGuid, CoGetInterfaceAndReleaseStream
> OLEAUT32.-gt; SHLWAPI.dll: StrStrIW, UrlUnescapeW, UrlEscapeW, StrStrIA, PathFileExistsW, StrRStrIW, StrCmpNW

( 7 exports )
DllCanUnloadNow, DllGetClassObject, DllUnregisterServer, e, i, l, r

Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=640B5B5E0049D090E00103466932FB00557F121A
CWSandbox info: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8247f8977ee9bda5a48753b0346d6b5c

Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 -
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6287 2009.01.01 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 -
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.03 -
NOD32 3733 2009.01.02 -
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 Fraudulent Security Program
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 Troj/BHO-IQ
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -

Additional information
File size: 253952 bytes
MD5...: 8247f8977ee9bda5a48753b0346d6b5c
SHA1..: 8edf5602625688a8c7fc8e4ef63b2dcd58c1a953
SHA256: 4468aae5e3f2a980c8e5d47733e8a723f1d1e03db4d25d337ffda906f19b78ec
SHA512: a223490bb3b4018e6a1a8f8ebd90f43f3dd46b5fd6ae710e0f56af06f4035c9a
d62fd0af4979110d31c4895c8d47988b81d898ca336370fd588a59be25760acb

ssdeep: 3072:kFKga7hdf519gFmhzbqfSkkcjwwJLfWvGEDUKiAYBDQ3apSe9P32I0nFIOZ
tw71+:KKgON8mhzbqfSkcwJLfOjiNBE3aIU7

PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10017964
timedatestamp.....: 0x492888a2 (Sat Nov 22 22:33:06 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x25eca 0x26000 6.69 e29a5beac684bb7217baf606e8312762
.rdata 0x27000 0xd599 0xe000 5.55 86ceb84a817be9ec7067cedc633f1daf
.data 0x35000 0x8200 0x5000 3.45 0bb56d6b0e4707d486cb1ae960775874
.reloc 0x3e000 0x3476 0x4000 5.05 54bd37fa5af85aab3ffae0e351709675

( 8 imports )
> VERSION.dll: VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
> KERNEL32.dll: CreateProcessW, lstrcpyW, lstrcatW, SystemTimeToFileTime, WideCharToMultiByte, ReadFile, GetFileSize, SetFilePointer, CreateFileW, InterlockedDecrement, InterlockedIncrement, GetProcAddress, LoadLibraryW, GetModuleFileNameW, SetEvent, Sleep, ResetEvent, WaitForSingleObject, OpenEventW, CreateMutexW, EnterCriticalSection, LeaveCriticalSection, CreateEventW, SetWaitableTimer, CancelWaitableTimer, GetLastError, CreateWaitableTimerW, OpenWaitableTimerW, lstrcpynA, GetTickCount, MultiByteToWideChar, CreateThread, lstrlenA, RaiseException, InitializeCriticalSection, DeleteCriticalSection, FreeLibraryAndExitThread, OpenMutexW, DisableThreadLibraryCalls, GetVersionExW, CloseHandle, lstrcmpW, FreeLibrary, LocalFree, OpenProcess, LocalAlloc, SetEndOfFile, WriteFile, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetSystemTime, WaitForMultipleObjects, FlushFileBuffers, CreateDirectoryW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, lstrcpyA, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, SetHandleCount, GetModuleFileNameA, GetStdHandle, GetOEMCP, VirtualQuery, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, ExitProcess, HeapSize, GetLocalTime, lstrlenW, lstrcpynW, GetSystemWindowsDirectoryW, GetVolumeInformationW, GetCurrentProcessId, ReleaseMutex, SetLastError, TlsFree, TlsSetValue, GetLocaleInfoW, LoadLibraryA, IsValidCodePage, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, TlsAlloc, TlsGetValue, GetModuleHandleA, GetStringTypeW, GetStringTypeA, GetCPInfo, LCMapStringW, LCMapStringA, GetProcessHeap, GetCommandLineA, GetCurrentThreadId, HeapReAlloc, HeapAlloc, GetSystemTimeAsFileTime, HeapFree, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, RtlUnwind, InterlockedCompareExchange, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, InterlockedExchange
> USER32.dll: GetWindowModuleFileNameW, SetWindowsHookExW, PostMessageW, CallNextHookEx, LockSetForegroundWindow, UnregisterClassA, SetWindowTextW, EnumChildWindows, FindWindowExW, SendMessageW, UpdateWindow, IsCharAlphaNumericW, IsCharAlphaW, MsgWaitForMultipleObjects, PeekMessageW, TranslateMessage, DispatchMessageW, wsprintfW, SetWindowPos
> ADVAPI32.dll: RegEnumValueW, RegFlushKey, RegNotifyChangeKeyValue, RegCreateKeyExW, RegQueryValueExW, RegDeleteValueW, RegOpenKeyExW, RegSetValueExW, RegCloseKey
> SHELL32.dll: SHGetFolderPathW, -, SHCreateDirectoryExW
> ole32.dll: CoMarshalInterThreadInterfaceInStream, CoInitializeEx, CoTaskMemFree, CoUninitialize, CoCreateInstance, OleRun, StringFromCLSID, CoCreateGuid, CoGetInterfaceAndReleaseStream
> OLEAUT32.-gt; SHLWAPI.dll: StrStrIW, UrlUnescapeW, UrlEscapeW, StrStrIA, PathFileExistsW, StrRStrIW, StrCmpNW

( 7 exports )
DllCanUnloadNow, DllGetClassObject, DllUnregisterServer, e, i, l, r

Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=640B5B5E0049D090E00103466932FB00557F121A
CWSandbox info: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8247f8977ee9bda5a48753b0346d6b5c


File DEC86EC0EA.sys received on 01.03.2009 08:09:15 (CET)
Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 -
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6289 2009.01.02 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 -
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.03 -
NOD32 3733 2009.01.02 -
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 -
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -
Additional information
File size: 56 bytes
MD5...: 1877c82dd672e7d5ce59cf4b5d2177b3
SHA1..: 073cd2a1e0c488f176e10b0317fd183fed7df1fe
SHA256: d3cc03fc98939546878a4bc025ab21a628f6cce7627296aed266837388904b34
SHA512: fd142af3bb8413b41fae7fa81135ac5b4eb5c959171aa725586a84c9bc15f78d
c0abf42b5a5202a41b27b88d8889cd1d9f98f9f1993ac8cf15cc64df9e6e51ac

ssdeep: 3:/lbalWu9Ljr5+Pn:5a8u9Xr5+Pn

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -

Antivirus Version Last Update Result
a-squared 4.0.0.73 2009.01.03 -
AhnLab-V3 2008.12.31.0 2009.01.02 -
AntiVir 7.9.0.45 2009.01.02 -
Authentium 5.1.0.4 2009.01.02 -
Avast 4.8.1281.0 2009.01.03 -
AVG 8.0.0.199 2009.01.02 -
BitDefender 7.2 2009.01.03 -
CAT-QuickHeal 10.00 2009.01.03 -
ClamAV 0.94.1 2009.01.03 -
Comodo 866 2009.01.02 -
DrWeb 4.44.0.09170 2009.01.03 -
eTrust-Vet 31.6.6289 2009.01.02 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.02 -
F-Secure 8.0.14470.0 2009.01.03 -
Fortinet 3.117.0.0 2009.01.03 -
GData 19 2009.01.03 -
Ikarus T3.1.1.45.0 2009.01.03 -
K7AntiVirus 7.10.572 2009.01.02 -
Kaspersky 7.0.0.125 2009.01.03 -
McAfee 5482 2009.01.02 -
McAfee+Artemis 5482 2009.01.02 -
Microsoft 1.4205 2009.01.03 -
NOD32 3733 2009.01.02 -
Norman 5.80.02 2009.01.02 -
Panda 9.0.0.4 2009.01.02 -
PCTools 4.4.2.0 2009.01.02 -
Prevx1 V2 2009.01.03 -
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.03 -
Sophos 4.37.0 2009.01.03 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.03 -
TheHacker 6.3.1.4.204 2009.01.02 -
TrendMicro 8.700.0.1004 2009.01.02 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2009.1.3.1541 2009.01.03 -
VirusBuster 4.5.11.0 2009.01.02 -

Additional information
File size: 56 bytes
MD5...: 1877c82dd672e7d5ce59cf4b5d2177b3
SHA1..: 073cd2a1e0c488f176e10b0317fd183fed7df1fe
SHA256: d3cc03fc98939546878a4bc025ab21a628f6cce7627296aed266837388904b34
SHA512: fd142af3bb8413b41fae7fa81135ac5b4eb5c959171aa725586a84c9bc15f78d
c0abf42b5a5202a41b27b88d8889cd1d9f98f9f1993ac8cf15cc64df9e6e51ac

ssdeep: 3:/lbalWu9Ljr5+Pn:5a8u9Xr5+Pn

PEiD..: -
TrID..: File type identification
MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -


Report •

#7
January 3, 2009 at 06:12:50
[b]SDFix: Version 1.240 [/b]
Run by Chris Joyce on Sat 01/03/2009 at 02:28 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

No Trojan Files Found


Removing Temp Files

[b]ADS Check [/b]:


[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 09:08:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Fri 7 Jul 2006 88 A.SHR --- "C:\i386\EAC06EC8DE.sys"
Fri 7 Jul 2006 3,350 A.SH. --- "C:\i386\KGyGaAvL.sys"
Wed 1 Sep 2004 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
Wed 1 Sep 2004 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
Wed 1 Sep 2004 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
Sat 26 Aug 2006 56 ..SHR --- "C:\WINDOWS\system32\DEC86EC0EA.sys"
Fri 24 Oct 2008 88 ..SHR --- "C:\WINDOWS\system32\EAC06EC8DE.sys"
Fri 24 Oct 2008 4,184 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 13 Jul 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 5 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Thu 13 Jul 2006 4,348 ...H. --- "C:\Documents and Settings\Chris Joyce\My Documents\My Music\License Backup\drmv1key.bak"
Thu 13 Jul 2006 20 A..H. --- "C:\Documents and Settings\Chris Joyce\My Documents\My Music\License Backup\drmv1lic.bak"
Thu 13 Jul 2006 400 A.SH. --- "C:\Documents and Settings\Chris Joyce\My Documents\My Music\License Backup\drmv2key.bak"
Fri 18 Jan 2008 97,792 A..H. --- "C:\Documents and Settings\Christina Meinke\My Documents\Town Report Documents\2007 Town Report\TEMPLATES\~WRL2231.tmp"
Sun 27 Jan 2008 37,888 A..H. --- "C:\Documents and Settings\Christina Meinke\My Documents\Town Report Documents\Town Report 2007\Financial07\~WRL1793.tmp"
Fri 1 Feb 2008 41,984 A..H. --- "C:\Documents and Settings\Christina Meinke\My Documents\Town Report Documents\Town Report 2007\Front_Back07\~WRL0561.tmp"
Fri 18 Jan 2008 97,792 A..H. --- "C:\Documents and Settings\Christina Meinke\My Documents\Town Report Documents\Town Report 2007\TEMPLATES\~WRL2231.tmp"

[b]Finished![/b]


Report •

#8
January 3, 2009 at 08:31:40
Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\Bcufunuhog.dat
c:\windows\evefimifetelag.dll

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.




Report •

#9
January 3, 2009 at 09:11:21
Combo fix report

ComboFix 09-01-01.02 - Chris Joyce 2009-01-03 12:00:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.171 [GMT -5:00]
Running from: c:\documents and settings\Chris Joyce\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Chris Joyce\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\Bcufunuhog.dat
c:\windows\evefimifetelag.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Bcufunuhog.dat
c:\windows\evefimifetelag.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.

2009-01-03 02:27 . 2009-01-03 02:27 578,560 --a------ c:\windows\system32\dllcache\user32.dll
2009-01-03 02:24 . 2009-01-03 02:24 <DIR> d-------- c:\windows\ERUNT
2009-01-03 02:22 . 2009-01-03 09:10 <DIR> d-------- C:\SDFix
2009-01-02 22:08 . 2009-01-03 01:25 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-02 21:40 . 2009-01-02 21:40 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-02 21:40 . 2009-01-02 21:40 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-01-02 21:40 . 2009-01-02 21:40 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-02 21:39 . 2009-01-02 21:44 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-02 21:39 . 2009-01-02 21:39 <DIR> d-------- c:\program files\AVG
2009-01-02 21:39 . 2009-01-02 22:32 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\AVGTOOLBAR
2009-01-02 21:39 . 2009-01-02 21:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\Malwarebytes
2009-01-02 08:47 . 2009-01-02 08:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-02 08:47 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-02 08:47 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-01 15:10 . 2009-01-01 15:10 <DIR> d-------- c:\program files\Trend Micro
2008-12-22 12:25 . 2008-12-22 12:25 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-09 08:13 . 2008-12-29 10:50 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-09 08:13 . 2008-12-29 09:04 <DIR> d-------- c:\documents and settings\Chris Joyce\Application Data\SUPERAntiSpyware.com
2008-12-09 08:13 . 2008-12-09 08:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 03:05 --------- d-----w c:\program files\Google
2009-01-02 16:54 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-22 17:25 --------- d-----w c:\program files\Java
2008-12-09 02:13 --------- d-----w c:\program files\Common Files\Adobe
2008-11-21 20:55 --------- d-----w c:\program files\RocketDock
2006-08-26 12:06 56 --sh--r c:\windows\system32\DEC86EC0EA.sys
.

((((((((((((((((((((((((((((( snapshot@2009-01-02_22.30.08.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-01-03 07:24:58 3,760,128 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat
+ 2009-01-03 07:24:58 217,088 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-01-03 07:24:44 3,760,128 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat
+ 2009-01-03 07:24:44 217,088 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2009-01-03 17:02:59 16,384 ----atw c:\windows\temp\Perflib_Perfdata_21c.dat
+ 2009-01-03 17:02:55 16,384 ----atw c:\windows\temp\Perflib_Perfdata_42c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2007-08-30 205480]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Yodm3D"="c:\documents and settings\All Users\Documents\Yodm3D\Yod'm 3D\Yodm3D.exe" [2007-04-21 2343936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 98304]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2007-08-28 73728]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-18 110592]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-18 8192]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2007-08-30 205480]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-04 267048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-22 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-02 1261336]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 c:\windows\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-01 24576]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2009-01-02 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-02 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-02 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2009-01-02 76040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-10-27 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{22909439-71f3-11dd-afaa-00038a000015}]
\Shell\AutoRun\command - I:\laucher.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: online.musicmatch.com
FF - ProfilePath - c:\documents and settings\Chris Joyce\Application Data\Mozilla\Firefox\Profiles\4ud47q0v.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl<mpl=yj_wsad<mplcache=2
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-03 12:03:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\Ati2evxx.dll
.
r Running Proce
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\MUSICM~1\MUSICM~3\MMDiag.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\MUSICMATCH\Musicmatch Jukebox\mim.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-01-03 12:07:45 - machine was rebooted [Chris Joyce]
ComboFix-quarantined-files.txt 2009-01-03 17:07:42
ComboFix2.txt 2009-01-03 03:31:07

Pre-Run: 57,617,117,184 bytes free
Post-Run: 57,611,104,256 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

185 --- E O F --- 2008-12-21 13:26:39


Report •

#10
January 3, 2009 at 09:13:03
Goored Log

GooredFix v1.6 by jpshortstuff
Log created at 12:12 on 03/01/2009 running Option #1
Firefox version 3.0.5 (en-US)

=====Suspect Goored Entries=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"="C:\Documents and Settings\Christina Meinke\Local Settings\Application Data\{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"="C:\Documents and Settings\Chris Joyce\Local Settings\Application Data\{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1d5287d1-8a92-0001-1f31-1cec198018d8}"="C:\Program Files\AVG\AVG8\ToolbarFF"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"="C:\Documents and Settings\Christina Meinke\Local Settings\Application Data\{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"="C:\Documents and Settings\Chris Joyce\Local Settings\Application Data\{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"


Report •

#11
January 3, 2009 at 09:17:07
Please double-click Goored.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt).

Let let me know if the redirects have subsided.


Report •

#12
January 3, 2009 at 09:51:42
GooredFix v1.6 by jpshortstuff
Log created at 12:49 on 03/01/2009 running Option #2
Firefox version 3.0.5 (en-US)

=====Goored Deletions=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"="C:\Documents and Settings\Christina Meinke\Local Settings\Application Data\{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Christina Meinke\Local Settings\Application Data\{AAF44517-2744-4E1F-AB95-E0A4B0EBEC9F}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"="C:\Documents and Settings\Chris Joyce\Local Settings\Application Data\{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Chris Joyce\Local Settings\Application Data\{C538C4E0-4A32-40C5-90E4-5A50D789D4D0}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1d5287d1-8a92-0001-1f31-1cec198018d8}"="C:\Program Files\AVG\AVG8\ToolbarFF"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"


Report •

#13
January 3, 2009 at 09:53:24
Well my friend, a few quick searches on old and new topics seem to show proper directing to selected links!

Whew! That was pretty involved!

Regards!

CJ


Report •

#14
January 3, 2009 at 10:04:15
Involved... is a real good word for these types of baddies.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Please run Esets online scanner from this link:

ESET

1. Note: You will need to use Internet explorer for this scan
2. Tick the box next to YES, I accept the Terms of Use.
3. Click Start
4. When asked, allow the activex control to install
5. Click Start
6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked
7. Click Scan
8. Wait for the scan to finish
9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
10. Copy and paste that log in your next reply.


Report •

#15
January 4, 2009 at 10:07:00
Whoops. . .I screwed up.

I didn't leave "remove threats" unticked. It found a version of a Win32 Trojan in c://Qoobox/quarantine/c/windows/Bcufunuhog.dat.vir and deleted it.

here's the log

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3735 (20090104)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=53330cae159b584cb6f2cda80b4faf50
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-01-04 03:48:06
# local_time=2009-01-04 10:48:06 (-0500, Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=439211
# found=1
# scan_time=3878
C:\Qoobox\Quarantine\C\WINDOWS\Bcufunuhog.dat.vir a variant of Win32/Cimag trojan (unable to clean - deleted)

I ran ESET again and it said "No Threats Found"


Report •

#16
January 4, 2009 at 14:49:39
That was just Combofix's quarantine folder.

You computer appears to be clean

Navigate to and delete this folder:

C:\SDFix

Empty the recycle bin.

Delete GooredFix from your desktop.

Go to start> run> type in combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

Go to start> control panel> add/remove programs and uninstall these programs:

Hijack This

Malwarebytes

Eset

You should keep AFT Cleaner and run it weekly.


You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster

Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

How is the computer operating?


Report •

#17
January 4, 2009 at 17:34:32
everything is okeedokee.

Thanks for your help!

CJ


Report •

#18
January 4, 2009 at 19:19:20
Glad we could help.

Report •


Ask Question