ComboFix 09-05-11.01 - Marshal 05/11/2009 14:48.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1279.872 [GMT -5:00] Running from: c:\documents and settings\Marshal\Desktop\toolb.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\LocalService\protect.dll c:\documents and settings\Marshal\Application Data\.# c:\documents and settings\Marshal\Application Data\pidle c:\documents and settings\Marshal\protect.dll c:\documents and settings\Marshal\Start Menu\Programs\Startup\ChkDisk.lnk c:\windows\system32\autochk.dll c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.lnk c:\windows\system32\drivers\ovfsthmddvkbowoeyotrnunoefyhmndxohyogr.sys c:\windows\system32\ovfsthhtfmxcpgtecvakwiflqhlvvrnrartkqg.dll c:\windows\system32\ovfsthjaijwykrndwplsbbhqajcgniffktpauf.dat c:\windows\system32\ovfsthkaispnxvdxdmxtvqmrbitlppcllrlaiq.dll c:\windows\system32\ovfsthkrjqweysodaqawtrpkacjmlsgmtaliye.dll c:\windows\system32\ovfsthsjdamricpvtgpfcjkipqqrsqnyjveigb.dat c:\windows\system32\test.ttt c:\windows\Tasks\ipqiprqg.job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ovfsthklywhsbaopwoyumafdkxvqtunyvcbaxe ((((((((((((((((((((((((( Files Created from 2009-04-11 to 2009-05-11 ))))))))))))))))))))))))))))))) . 2009-05-11 19:02 . 2009-05-11 19:02 410984 ----a-w c:\windows\system32\deploytk.dll 2009-05-10 03:27 . 2009-05-10 18:21 -------- d-----w c:\documents and settings\Marshal\Local Settings\Application Data\CurseClient 2009-05-10 03:26 . 2009-05-10 03:26 -------- d-----w c:\program files\Curse 2009-05-10 02:41 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-05-10 02:41 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-05-10 02:41 . 2009-05-10 02:41 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-08 01:58 . 2009-05-08 02:02 -------- d-----w c:\program files\Windows Live Safety Center 2009-05-08 01:36 . 2009-05-09 00:26 -------- d-----w c:\windows\system32\796525 2009-05-02 03:02 . 2009-05-02 03:02 -------- d-----w c:\documents and settings\Administrator.TWOFACED\Application Data\Malwarebytes 2009-05-02 03:01 . 2009-05-02 03:01 -------- d-----w c:\documents and settings\Administrator.TWOFACED\Local Settings\Application Data\Mozilla 2009-05-01 21:16 . 2008-04-14 08:42 26112 ----a-w c:\windows\system32\userinit.exe 2009-04-29 06:09 . 2009-05-11 19:00 -------- d--h--w C:\$AVG8.VAULT$ 2009-04-29 06:05 . 2009-04-29 06:05 10520 ----a-w c:\windows\system32\avgrsstx.dll 2009-04-29 06:05 . 2009-04-29 06:05 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-04-29 06:05 . 2009-04-29 06:05 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-04-29 06:04 . 2009-05-11 13:39 -------- d-----w c:\windows\system32\drivers\Avg 2009-04-29 06:04 . 2009-04-29 06:04 -------- d-----w c:\program files\AVG 2009-04-29 06:04 . 2009-05-11 19:25 -------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-04-29 04:30 . 2004-07-14 10:10 58640 ----a-w c:\windows\zllsputility.exe 2009-04-29 02:16 . 2009-05-10 05:00 664 ----a-w c:\windows\system32\d3d9caps.dat 2009-04-28 07:25 . 2009-04-28 07:25 -------- d-----w c:\program files\Kaspersky Lab 2009-04-28 07:18 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-28 07:18 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-28 07:18 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe 2009-04-28 07:18 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-28 07:18 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-28 07:18 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-28 07:18 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll 2009-04-28 07:18 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-28 07:18 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-28 07:16 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll 2009-04-28 07:16 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-28 06:13 . 2009-04-28 06:13 -------- d-----w c:\documents and settings\All Users\Application Data\eAcceleration 2009-04-28 06:13 . 2009-04-28 06:13 -------- d-----w c:\program files\eAcceleration 2009-04-28 06:13 . 2009-04-28 06:13 -------- d-----w c:\program files\StopSign 2009-04-28 06:01 . 2009-04-28 06:01 -------- d-----w C:\kav 2009-04-27 17:57 . 2009-04-27 17:57 -------- d-----w C:\My Downloads 2009-04-23 03:13 . 2009-04-28 07:22 -------- d-----w c:\program files\Spyware Doctor 2009-04-23 03:05 . 2009-04-29 05:46 -------- d-----w c:\program files\Norton Security Scan 2009-04-23 03:02 . 2009-05-11 04:48 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2009-04-22 22:29 . 2009-04-22 22:29 -------- d-----w c:\documents and settings\Marshal\Logs 2009-04-22 21:55 . 2009-04-22 21:55 -------- d-----w c:\documents and settings\All Users\Application Data\Blizzard 2009-04-22 20:00 . 2009-04-22 20:00 -------- d-----w C:\Logs 2009-04-22 09:34 . 2009-04-22 09:34 -------- d-----w c:\documents and settings\All Users\Application Data\Azureus 2009-04-22 09:34 . 2009-04-22 09:45 -------- d-----w c:\documents and settings\Marshal\Application Data\Azureus 2009-04-22 04:05 . 2009-04-22 04:05 -------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-04-22 04:05 . 2009-05-07 02:44 -------- d-----w c:\program files\World of Warcraft 2009-04-20 00:06 . 2009-04-20 00:06 -------- d-----w c:\documents and settings\Marshal\Application Data\Total Eclipse 2009-04-16 08:45 . 2009-04-16 08:45 -------- d-----w c:\documents and settings\Marshal\Application Data\Ludia 2009-04-16 08:45 . 2009-04-16 08:45 -------- d-----w c:\documents and settings\All Users\Application Data\Ludia 2009-04-15 07:47 . 2009-04-15 07:47 -------- d-----w c:\documents and settings\Marshal\Application Data\Shape games 2009-04-14 00:19 . 2009-04-14 17:22 -------- d-----w c:\program files\PlaySEGA 2009-04-12 19:41 . 2009-04-12 23:17 -------- d-----w c:\documents and settings\All Users\Application Data\FarmFrenzy2 2009-04-12 08:19 . 2009-04-14 17:26 -------- d-----w c:\program files\LimeWire . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-11 19:01 . 2008-05-12 22:45 -------- d-----w c:\program files\Java 2009-05-08 07:00 . 2008-12-18 10:21 -------- d-----w c:\program files\OneStepSrch 2009-05-01 23:18 . 2009-03-17 23:44 -------- d-----w c:\program files\iWin.com 2009-04-29 04:30 . 2008-03-25 19:58 4212 ---h--w c:\windows\system32\zllictbl.dat 2009-04-28 08:03 . 2008-08-06 16:14 -------- d-----w c:\program files\Microsoft ActiveSync 2009-04-23 03:02 . 2009-02-03 07:59 -------- d-----w c:\program files\Google 2009-04-03 05:07 . 2009-03-06 16:54 -------- d-----w c:\program files\MySpace 2009-03-28 07:17 . 2009-03-28 07:17 -------- d-----w c:\program files\Common Files\Windows Live 2009-03-17 00:54 . 2009-03-16 23:49 -------- d-----w c:\program files\James Patterson Women's Murder Club - A Darker Shade of Grey 2009-03-16 20:19 . 2009-02-25 07:46 -------- d-----w c:\program files\RealArcade 2009-03-06 14:22 . 2003-03-31 12:00 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2006-06-23 19:33 826368 ----a-w c:\windows\system32\wininet.dll 2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll 2008-12-09 05:05 . 2008-11-02 01:52 88 --sh--r c:\windows\system32\162616E133.sys 2008-12-09 05:05 . 2008-11-02 01:52 2516 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-03-06 50528] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-11-16 1200128] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-23 39408] "CurseClient"="c:\program files\Curse\CurseClient.exe" [2009-04-24 1836032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-03 185872] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-29 1932568] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888] c:\documents and settings\Marshal\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] Sprint media monitor.lnk - c:\windows\RM.exe [2008-11-22 222552] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.exe [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-04-29 06:05 10520 ----a-w c:\windows\system32\avgrsstx.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "aux"= ctwdm32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\AVG\\AVG8\\avgui.exe"= "c:\\Program Files\\Spybot - Search & Destroy\\SpybotSD.exe"= "c:\\Program Files\\World of Warcraft\\Launcher.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"= "c:\\Program Files\\Curse\\CurseClient.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:ActiveSync Service "21095:TCP"= 21095:TCP:BitComet 21095 TCP "21095:UDP"= 21095:UDP:BitComet 21095 UDP "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/29/2009 1:05 AM 325640] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/29/2009 1:05 AM 108552] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/29/2009 1:04 AM 298264] S2 eac_notifysvc;eAcceleration Notification Service;c:\progra~1\EACCEL~1\FRAMEW~1\eac_svc.exe [4/28/2009 1:13 AM 111952] S2 eac_productsvc;eAcceleration Product Manager Service;c:\progra~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe [4/28/2009 1:13 AM 263504] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb4ec6a5-faa6-11dc-84fc-0013d3cd3090}] \Shell\AutoRun\command - F:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2009-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57] 2009-05-11 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-23 03:02] . - - - - ORPHANS REMOVED - - - - BHO-{C2BA40A1-74F3-42BD-F434-12345A2C8953} - (no file) BHO-{E7F15AC4-E0A9-43F0-921B-70DFEA621220} - c:\windows\system32\796525\796525.dll HKU-Default-Run-Windows Resurections - c:\windows\TEMP\e8xk56nu9.exe HKU-Default-Run-autochk - c:\docume~1\LOCALS~1\protect.dll SafeBoot-OneCareMP . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com Trusted Zone: mozilla.com\www FF - ProfilePath - c:\documents and settings\Marshal\Application Data\Mozilla\Firefox\Profiles\5ok5z74w.default\ FF - prefs.js: browser.startup.homepage - hxxp://myspace.com FF - prefs.js: keyword.URL - hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Web&orig=IMC-FF&qry= FF - prefs.js: network.proxy.http - localhost FF - prefs.js: network.proxy.http_port - 7171 FF - prefs.js: network.proxy.type - 4 FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-11 14:49 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:õwjY *] "DisplayName"="???\16?\11\[u]0[/u]9" "DeviceDesc"="???\16?\11\[u]0[/u]9" "ProviderName"="???\11?\17?\11??" "MFG"="???????" "ReinstallString"=".10.1000.5" "DeviceInstanceIds"=multi:"d:\\ati\\rs480\\sbdrv\\smbus\\smbusati.inf\[u]0[/u]0" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(524) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-05-11 14:51 ComboFix-quarantined-files.txt 2009-05-11 19:51 Pre-Run: 194,471,268,352 bytes free Post-Run: 196,393,213,952 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 217 --- E O F --- 2009-04-28 08:08 hijack this Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:54:18 PM, on 5/11/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\explorer.exe C:\Program Files\AVG\AVG8\avgui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Marshal\Desktop\tools.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie... R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM') O4 - S-1-5-18 Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user') O4 - .DEFAULT Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Sprint media monitor.lnk = C:\WINDOWS\RM.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {038E2507-7A48-41E2-94AD-7F23D199AF4E} (ZenGems Control) - http://www.worldwinner.com/games/v5... O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re... O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v4... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic... O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/sh... O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v4... O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - http://www.worldwinner.com/games/v5... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/g... O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: eAcceleration Notification Service (eac_notifysvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe O23 - Service: eAcceleration Product Manager Service (eac_productsvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe -- End of file - 8277 bytes

0

Are you still being redirected? Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. 3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. 4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. 5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. 6. Click View scan report at the bottom. 7. Click the Save Report As... button. 8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. **Note** To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

0

Yes, i'm still being redirected :\ I'm running Kaspersky right now.

0

Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

0

-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, May 11, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Tuesday, May 12, 2009 00:14:00 Records in database: 2163952 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 79636 Threat name: 5 Infected objects: 7 Suspicious objects: 0 Duration of the scan: 02:03:18 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\Documents and Settings\LocalService\protect.dll.vir Infected: Trojan-Spy.Win32.Agent.aoox 1 C:\Qoobox\Quarantine\C\Documents and Settings\Marshal\protect.dll.vir Infected: Trojan-Spy.Win32.Agent.aoox 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\autochk.dll.vir Infected: Trojan-Spy.Win32.Agent.aoox 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ovfsthmddvkbowoeyotrnunoefyhmndxohyogr.sys.vir Infected: Trojan.Win32.Tdss.aalf 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthhtfmxcpgtecvakwiflqhlvvrnrartkqg.dll.vir Infected: Trojan.Win32.Tdss.aalg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthkaispnxvdxdmxtvqmrbitlppcllrlaiq.dll.vir Infected: Trojan.Win32.Tdss.aald 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthkrjqweysodaqawtrpkacjmlsgmtaliye.dll.vir Infected: Trojan.Win32.Tdss.aalc 1 The selected area was scanned.

0

GooredFix v1.92 by jpshortstuff Log created at 21:09 on 11/05/2009 running Option #1 (Marshal) Firefox version 3.0.10 (en-US) =====Suspect Goored Entries===== C:\Program Files\Mozilla Firefox\extensions\{CF0EDAFE-AD92-4086-93C8-13386D97F5CE} C:\Program Files\Mozilla Firefox\extensions\{B9ADB258-DE5D-46A0-AAB6-D3A7467C6018} C:\Program Files\Mozilla Firefox\extensions\{821D1C4F-D6CD-4BA2-B5AD-2A96E2D8D3AE} C:\Program Files\Mozilla Firefox\extensions\{74F7C01D-5525-4203-88A5-791DB5BDC838} C:\Program Files\Mozilla Firefox\extensions\{01DC32A1-685B-434D-B569-6CB1585F3733} =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

0

Please double-click Goored.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Let me know if the redirects have ceased.

0

From what I can tell, they have stopped!

0

Go to start> run> type in combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run. Navigate to and delete this Combofix quarantine folder if found: C:\Qoobox Go to start> control panel> add/remove programs and uninstall these programs: Hijack This Malwarebytes Kaspersky You should keep AFT Cleaner and run it weekly. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. How is the computer operating?

0