Help! No one is responding!!

Dell Latitude d600
January 30, 2009 at 07:21:50
Specs: Windows XP, Intel Pentium M, 512
Please help me get rid of my Google Hijack (sporadically redirects search results to shopzilla and others). I have AVG and Ad Aware SUPERAntiSpyware and Malwarebytes, none of which detected it. Every forum and blog I go to on this hijacker involves posting logs. I use Firefox, and I downloaded Adobe Acrobat 9. Please help, no one responded to my last post and I can't do this by myself!! Thank you!!


See More: Help! No one is responding!!

Report •


#1
January 30, 2009 at 12:30:51

Report •

#2
January 30, 2009 at 17:26:53
It removed 5 files. But I still have the virus. It just redirected me to Shopica. Please help, I really appreciate it, thank you!

Report •

#3
January 31, 2009 at 11:31:39
Please download and install the latest version of HijackThis v2.0.2:


Download the "HijackThis" Installer from this link:
Hijack This


1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.


Report •

Related Solutions

#4
January 31, 2009 at 14:49:28
Here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:46:41 PM, on 1/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Buffy\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 0.0.0.0:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Buffy\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite...
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Bejeweled%202/Images/stg_drm.ocx
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/Walgreen...
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySp...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/download...
O16 - DPF: {ACEFFC26-4628-11D1-B14A-105C01C13001} (WSpell Spelling Checker Control) - https://www.pdesigner.com/pd3/htmlEditor/wspell.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Bejeweled%202/Images/armhelper.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com...
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neu...
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll ,
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: mlJCUOgE - mlJCUOgE.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 11000 bytes

Thank you so much.


Report •

#5
January 31, 2009 at 17:21:54
Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Rename the setup file, combofix.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename combofix.exe to toolb.exe> click save.

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, Ad-Aware and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#6
February 1, 2009 at 10:22:45
I hope I did that right. Here's the log:

ComboFix 09-02-01.01 - Buffy 2009-02-01 11:06:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.236 [GMT -7:00]
Running from: c:\documents and settings\Buffy\Desktop\toolb.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Buffy\Cookies\akaxo.ban
c:\documents and settings\Buffy\Cookies\evos.reg
c:\documents and settings\Buffy\Cookies\gevevupo.inf
c:\documents and settings\Buffy\Cookies\qoruno.bin
c:\documents and settings\Buffy\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Buffy\Local Settings\Temporary Internet Files\sojawadu._dl
c:\documents and settings\Buffy\Local Settings\Temporary Internet Files\ysopiriken.scr
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\temp\tn3
c:\windows\system32\AutoRun.inf
c:\windows\system32\ki3
c:\windows\system32\VC
c:\windows\Tasks\gjngyezc.job

.
((((((((((((((((((((((((( Files Created from 2009-01-01 to 2009-02-01 )))))))))))))))))))))))))))))))
.

2009-01-30 16:04 . 2009-01-30 16:04 <DIR> d-------- c:\program files\ESET
2009-01-28 17:28 . 2009-01-28 17:30 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-28 13:33 . 2009-01-28 18:55 <DIR> d-------- c:\program files\NOS
2009-01-28 13:33 . 2009-01-28 18:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-01-28 12:59 . 2009-01-28 12:59 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-28 12:59 . 2009-01-28 12:59 <DIR> d-------- c:\documents and settings\Buffy\Application Data\SUPERAntiSpyware.com
2009-01-28 12:59 . 2009-01-28 12:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-26 17:17 . 2009-01-26 17:17 <DIR> d-------- c:\documents and settings\Buffy\Application Data\Unity
2009-01-21 13:06 . 2009-01-30 16:38 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-21 13:06 . 2009-01-21 13:06 1,409 --a------ c:\windows\QTFont.for
2009-01-09 20:28 . 2009-01-09 22:08 138,469 --a------ c:\windows\system32\rn.tmp
2009-01-07 17:01 . 2009-01-07 17:08 <DIR> d-------- c:\documents and settings\Buffy\Application Data\IMVUClient
2009-01-07 17:01 . 2009-01-27 19:59 <DIR> d-------- c:\documents and settings\Buffy\Application Data\IMVU
2009-01-03 20:11 . 2009-01-03 20:11 <DIR> d-------- c:\program files\LEGO Company
2009-01-03 20:11 . 2009-01-03 20:11 <DIR> d-------- c:\documents and settings\Buffy\Application Data\LEGO Company
2009-01-03 18:59 . 2009-01-09 22:15 <DIR> d-------- c:\documents and settings\Buffy\Application Data\vlc
2009-01-03 16:28 . 2009-01-03 16:28 <DIR> d-------- C:\Graboid
2009-01-03 16:20 . 2009-01-03 16:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\Launcher
2009-01-03 16:19 . 2009-01-03 16:20 <DIR> d-------- c:\documents and settings\Buffy\Application Data\MozillaControl
2009-01-03 16:19 . 2009-01-03 16:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\Graboid Inc
2009-01-03 16:12 . 2009-01-03 16:12 <DIR> d-------- c:\program files\VideoLAN
2009-01-03 16:12 . 2009-01-03 16:12 <DIR> d-------- c:\program files\Mozilla ActiveX Control v1.7.12
2009-01-03 16:12 . 2009-01-03 16:19 <DIR> d-------- c:\program files\Graboid
2009-01-03 11:43 . 2009-01-03 11:43 <DIR> d-------- c:\program files\MySpace
2009-01-03 11:43 . 2009-01-03 11:43 <DIR> d-------- c:\documents and settings\Buffy\Application Data\MySpace
2009-01-02 18:27 . 2009-01-02 18:27 <DIR> d-------- c:\program files\Unity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-28 19:58 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-26 02:51 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-17 00:48 --------- d-----w c:\program files\Check Printing Software 2000 V2.0
2009-01-17 00:47 --------- d-----w c:\program files\DivX
2009-01-14 23:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 23:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-10 23:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 01:51 --------- d-----w c:\program files\Microsoft Works
2008-12-23 22:09 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-23 21:39 --------- d-----w c:\documents and settings\Buffy\Application Data\SpinTop
2008-12-23 02:31 --------- d-----w c:\program files\Java
2008-12-21 17:49 --------- d-----w c:\documents and settings\Buffy\Application Data\Move Networks
2008-12-14 18:32 --------- d-----w c:\program files\Generations
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-07 02:04 --------- d-----w c:\documents and settings\Buffy\Application Data\Malwarebytes
2008-12-07 02:04 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-06 05:41 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-06 05:40 --------- d-----w c:\program files\Lavasoft
2008-12-02 04:21 --------- d-----w c:\documents and settings\All Users\Application Data\HPSSUPPLY
2008-12-02 04:12 --------- d-----w c:\program files\HP
2008-12-02 04:12 --------- d-----w c:\documents and settings\Buffy\Application Data\HPAppData
2008-12-02 04:09 --------- d-----w c:\program files\Hewlett-Packard
2008-12-02 04:09 --------- d-----w c:\documents and settings\All Users\Application Data\HP Product Assistant
2008-12-02 04:09 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-01 23:14 --------- d-----w c:\program files\EZ-Filing
2008-11-17 22:28 14,323 ----a-w c:\windows\golebi.bin
2008-11-17 22:28 10,162 ----a-w c:\documents and settings\Buffy\Application Data\gakome.bin
2008-11-12 02:35 30 ----a-w c:\documents and settings\Buffy\jagex_runescape_preferences.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-10 344064]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-29 1261336]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-22 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 09:46 217544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2004-02-02 14:32 155648 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 17:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2007-02-12 02:24 109304 c:\program files\Roxio\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 09:36 267048 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-30 12:51 413696 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2007-02-12 08:05 1121016 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
--a------ 2007-08-16 07:56 236016 c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-09 22:28 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10107:TCP"= 10107:TCP:BitComet 10107 TCP
"10107:UDP"= 10107:UDP:BitComet 10107 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"60000:TCP"= 60000:TCP:BitComet 60000 TCP
"60000:UDP"= 60000:UDP:BitComet 60000 UDP
"21968:TCP"= 21968:TCP:BitComet 21968 TCP
"21968:UDP"= 21968:UDP:BitComet 21968 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-17 97928]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-17 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-17 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-17 76040]
S1 c2scsi;c2scsi;c:\windows\system32\drivers\c2scsi.sys [2008-09-25 241664]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-01-26 c:\windows\Tasks\WebReg Photosmart C4200 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 21:27]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-EPSON Stylus Photo R320 Series - c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE
Notify-mlJCUOgE - mlJCUOgE.dll
Notify-NavLogon - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
MSConfigStartUp-Pguceqijiwaw - c:\windows\Hjipimaxeqayofi.dll
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_05\bin\jusched.exe
MSConfigStartUp-Swahefedaw - c:\windows\epelusasiy.dll


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 0.0.0.0:80
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Buffy\Start Menu\Programs\IMVU\Run IMVU.lnk
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Bejeweled%202/Images/stg_drm.ocx
DPF: {ACEFFC26-4628-11D1-B14A-105C01C13001} - hxxps://www.pdesigner.com/pd3/htmlEditor/wspell.cab
FF - ProfilePath - c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.lifeprint.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-01 11:13:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(892)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
r Running Proce
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\ati2evxx.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-02-01 11:19:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-01 18:17:56

Pre-Run: 16,680,656,896 bytes free
Post-Run: 17,767,530,496 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

236 --- E O F --- 2009-01-13 22:10:48


Thank you, again.


Report •

#7
February 1, 2009 at 17:15:28
Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, File, Folder, Registry etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\system32\rn.tmp

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Please post the log that is produced.

Please go to Virus Total and upload the following files, one at the time, for analysis:

c:\windows\golebi.bin

c:\documents and settings\Buffy\Application Data\gakome.bin

Use the browse button at the site to find the file, once you find the file double click it and it should appear in the empty space to the left of the browse button> click "send file".

Post the results in your reply.


Report •

#8
February 5, 2009 at 12:58:28
Ok, here is the combofix log:

ComboFix 09-02-05.01 - Buffy 2009-02-05 13:42:42.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.102 [GMT -7:00]
Running from: c:\documents and settings\Buffy\Desktop\toolb.exe
Command switches used :: c:\documents and settings\Buffy\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\rn.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\rn.tmp

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-03 16:06 . 2009-02-03 16:06 <DIR> d-------- c:\program files\2nd Story Software
2009-02-03 16:06 . 2009-02-03 16:06 57 --a------ c:\windows\TaxACT08.ini
2009-01-30 16:04 . 2009-01-30 16:04 <DIR> d-------- c:\program files\ESET
2009-01-28 17:28 . 2009-01-28 17:30 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-28 13:33 . 2009-01-28 18:55 <DIR> d-------- c:\program files\NOS
2009-01-28 13:33 . 2009-01-28 18:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-01-28 12:59 . 2009-01-28 12:59 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-28 12:59 . 2009-01-28 12:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-21 13:06 . 2009-02-01 18:44 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-21 13:06 . 2009-01-21 13:06 1,409 --a------ c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 20:26 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-05 20:26 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-05 20:26 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-28 19:58 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-26 02:51 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-17 00:48 --------- d-----w c:\program files\Check Printing Software 2000 V2.0
2009-01-17 00:47 --------- d-----w c:\program files\DivX
2009-01-14 23:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 23:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-10 23:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 01:51 --------- d-----w c:\program files\Microsoft Works
2009-01-04 03:11 --------- d-----w c:\program files\LEGO Company
2009-01-03 23:20 --------- d-----w c:\documents and settings\All Users\Application Data\Launcher
2009-01-03 23:19 --------- d-----w c:\program files\Graboid
2009-01-03 23:19 --------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-01-03 23:12 --------- d-----w c:\program files\VideoLAN
2009-01-03 23:12 --------- d-----w c:\program files\Mozilla ActiveX Control v1.7.12
2009-01-03 18:43 --------- d-----w c:\program files\MySpace
2009-01-03 01:27 --------- d-----w c:\program files\Unity
2008-12-23 22:09 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-23 02:31 --------- d-----w c:\program files\Java
2008-12-14 18:32 --------- d-----w c:\program files\Generations
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-07 02:04 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-06 05:41 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-06 05:40 --------- d-----w c:\program files\Lavasoft
2008-11-17 22:28 14,323 ----a-w c:\windows\golebi.bin
2008-11-12 02:35 30 ----a-w c:\documents and settings\Buffy\jagex_runescape_preferences.dat
.

((((((((((((((((((((((((((((( snapshot@2009-02-01_11.16.50.66 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-20 12:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE
+ 2005-10-21 03:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00 286,720 ----a-w c:\windows\SWREG.exe
+ 2000-08-31 15:00:00 161,792 ----a-w c:\windows\SWREG.exe
- 2008-11-17 23:53:38 10,520 ----a-w c:\windows\system32\avgrsstx.dll
+ 2009-02-05 20:26:47 10,520 ----a-w c:\windows\system32\avgrsstx.dll
- 2008-11-17 23:53:30 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys
+ 2009-02-05 20:26:46 27,656 ----a-w c:\windows\system32\drivers\avgmfx86.sys
+ 2009-02-05 20:47:26 16,384 ----atw c:\windows\temp\Perflib_Perfdata_5b4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-10 344064]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-29 1261336]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-22 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-05 13:26 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-03-20 09:46 217544 c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2004-02-02 14:32 155648 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 17:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2007-02-12 02:24 109304 c:\program files\Roxio\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 09:36 267048 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-30 12:51 413696 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
--a------ 2007-02-12 08:05 1121016 c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
--a------ 2007-08-16 07:56 236016 c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-09 22:28 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10107:TCP"= 10107:TCP:BitComet 10107 TCP
"10107:UDP"= 10107:UDP:BitComet 10107 UDP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"60000:TCP"= 60000:TCP:BitComet 60000 TCP
"60000:UDP"= 60000:UDP:BitComet 60000 UDP
"21968:TCP"= 21968:TCP:BitComet 21968 TCP
"21968:UDP"= 21968:UDP:BitComet 21968 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-17 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-17 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-17 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-17 231704]
S1 c2scsi;c2scsi;c:\windows\system32\drivers\c2scsi.sys [2008-09-25 241664]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 0.0.0.0:80
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Buffy\Start Menu\Programs\IMVU\Run IMVU.lnk
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Bejeweled%202/Images/stg_drm.ocx
DPF: {ACEFFC26-4628-11D1-B14A-105C01C13001} - hxxps://www.pdesigner.com/pd3/htmlEditor/wspell.cab
FF - ProfilePath - c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.lifeprint.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Buffy\Application Data\Mozilla\Firefox\Profiles\93sw8jcw.default\extensions\OberonGameHost@OberonGames.com\platform\WINNT_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-05 13:49:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(908)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
r Running Proce
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\ati2evxx.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-02-05 13:54:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-05 20:53:38
ComboFix2.txt 2009-02-01 18:19:19

Pre-Run: 17,526,026,240 bytes free
Post-Run: 17,525,362,688 bytes free

202 --- E O F --- 2009-01-13 22:10:48

Now I will go get the other files.
Thank you,
Jessica


Report •

#9
February 5, 2009 at 13:06:41
Here is the golebi.bin scan:

File golebi.bin received on 02.05.2009 21:59:53 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/37 (0%)

Antivirus Version Last Update Result
a-squared 4.0.0.93 2009.02.05 -
AhnLab-V3 5.0.0.2 2009.02.05 -
AntiVir 7.9.0.74 2009.02.05 -
Authentium 5.1.0.4 2009.02.05 -
Avast 4.8.1281.0 2009.02.05 -
AVG 8.0.0.229 2009.02.05 -
BitDefender 7.2 2009.02.05 -
CAT-QuickHeal 10.00 2009.02.05 -
ClamAV 0.94.1 2009.02.05 -
Comodo 965 2009.02.05 -
DrWeb 4.44.0.09170 2009.02.05 -
eSafe 7.0.17.0 2009.02.05 -
eTrust-Vet 31.6.6343 2009.02.05 -
F-Prot 4.4.4.56 2009.02.05 -
Fortinet 3.117.0.0 2009.02.05 -
GData 19 2009.02.05 -
Ikarus T3.1.1.45.0 2009.02.05 -
K7AntiVirus 7.10.620 2009.02.05 -
Kaspersky 7.0.0.125 2009.02.05 -
McAfee 5516 2009.02.04 -
McAfee+Artemis 5516 2009.02.04 -
Microsoft 1.4306 2009.02.05 -
NOD32 3831 2009.02.05 -
Norman 6.00.02 2009.02.05 -
nProtect 2009.1.8.0 2009.02.05 -
Panda 9.5.1.2 2009.02.05 -
PCTools 4.4.2.0 2009.02.05 -
Rising 21.15.30.00 2009.02.05 -
SecureWeb-Gateway 6.7.6 2009.02.05 -
Sophos 4.38.0 2009.02.05 -
Sunbelt 3.2.1835.2 2009.01.16 -
Symantec 10 2009.02.05 -
TheHacker 6.3.1.5.247 2009.02.05 -
TrendMicro 8.700.0.1004 2009.02.05 -
VBA32 3.12.8.12 2009.02.05 -
ViRobot 2009.2.5.1591 2009.02.05 -
VirusBuster 4.5.11.0 2009.02.05 -
Additional information
File size: 14323 bytes
MD5...: 57279a05e2c08a4dcf14e5ccaf4512c0
SHA1..: 08903176575ed5d28a7ac40fdcdb7b5e53224b5c
SHA256: 471a9b7c263852d840099359b65808c49a3fbc00acb1fdc7475c7d5d27e162dd
SHA512: 1b56576dd22c2b3e95b84d73954153bb1043921215cab7fa5dff2ccb55abc38e
0f417d6c431fdedf993fadc471f1c0ea2595f02946521e53026a181a65430655
ssdeep: 384:pmX1Tw5NiB6IaMR1F6D7nulc2J8u0jo+wpyDoQzn3h:+ouR1FshjUmoQD3h
PEiD..: -
TrID..: File type identification
MPEG Video (74.9%)
BONK lossless/lossy audio compressor (25.0%)
PEInfo: -


Report •

#10
February 5, 2009 at 13:15:22
Ok here is the second file scan:

File gakome.bin received on 02.05.2009 22:12:34 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/39 (0%)
Loading server information...
Your file is queued in position: 3.
Estimated start time is between 56 and 80 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.0.0.93 2009.02.05 -
AhnLab-V3 5.0.0.2 2009.02.05 -
AntiVir 7.9.0.74 2009.02.05 -
Authentium 5.1.0.4 2009.02.05 -
Avast 4.8.1281.0 2009.02.05 -
AVG 8.0.0.229 2009.02.05 -
BitDefender 7.2 2009.02.05 -
CAT-QuickHeal 10.00 2009.02.05 -
ClamAV 0.94.1 2009.02.05 -
Comodo 965 2009.02.05 -
DrWeb 4.44.0.09170 2009.02.05 -
eSafe 7.0.17.0 2009.02.05 -
eTrust-Vet 31.6.6343 2009.02.05 -
F-Prot 4.4.4.56 2009.02.05 -
F-Secure 8.0.14470.0 2009.02.05 -
Fortinet 3.117.0.0 2009.02.05 -
GData 19 2009.02.05 -
Ikarus T3.1.1.45.0 2009.02.05 -
K7AntiVirus 7.10.620 2009.02.05 -
Kaspersky 7.0.0.125 2009.02.05 -
McAfee 5516 2009.02.04 -
McAfee+Artemis 5516 2009.02.04 -
Microsoft 1.4306 2009.02.05 -
NOD32 3831 2009.02.05 -
Norman 6.00.02 2009.02.05 -
nProtect 2009.1.8.0 2009.02.05 -
Panda 9.5.1.2 2009.02.05 -
PCTools 4.4.2.0 2009.02.05 -
Prevx1 V2 2009.02.05 -
Rising 21.15.30.00 2009.02.05 -
SecureWeb-Gateway 6.7.6 2009.02.05 -
Sophos 4.38.0 2009.02.05 -
Sunbelt 3.2.1835.2 2009.01.16 -
Symantec 10 2009.02.05 -
TheHacker 6.3.1.5.247 2009.02.05 -
TrendMicro 8.700.0.1004 2009.02.05 -
VBA32 3.12.8.12 2009.02.05 -
ViRobot 2009.2.5.1591 2009.02.05 -
VirusBuster 4.5.11.0 2009.02.05 -
Additional information
File size: 10162 bytes
MD5...: 8afe52b9b48c21f9ae843f489198f2a8
SHA1..: 749cad0fe018f73ffd69377b5e6d70cadb847219
SHA256: 43e6b5ed54994e6a4b6d5ee124e6e6643ad89432521fc66000773086bc09006e
SHA512: a544b1411779138e0aa4377d749ae52a6cec8e953d51c9f8e97f0cccca2d0ad5
b8f9246a9391dcf82f3f065c001aaddeb7522982c0d887590a8731dc3bb53296
ssdeep: 192:WLwgg8j47LHFaTat6YeoQKrysc7SVI4tbI6RLJBw9qOcUXPQWYknv:WLq8jb
K6DWra4dDD8XrYE
PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -


Report •

#11
February 5, 2009 at 17:07:39
Have the redirects subsided?

Report •

#12
February 5, 2009 at 18:04:30
No, I just clicked on a google search result for www.ehow.com and was redirected to this site: www. bizrate .com /mkt. xpml?mkt_id =240365849

Upon going back and clicking a second time, I got the real ehow site.
Thank you...


Report •

#13
February 5, 2009 at 18:48:02
Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
6. Click View scan report at the bottom.
7. Click the Save Report As... button.
8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Report •

#14
February 6, 2009 at 06:29:10
Here is the Goored Log:
GooredFix v1.6 by jpshortstuff
Log created at 07:26 on 06/02/2009 running Option #1
Firefox version 3.0.6 (en-US)

=====Suspect Goored Entries=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"="C:\Documents and Settings\Buffy\Local Settings\Application Data\{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.6\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.6\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"="C:\Documents and Settings\Buffy\Local Settings\Application Data\{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"

I will do the Kapersky one now and post in my next reply...


Report •

#15
February 6, 2009 at 10:14:03
Kapersky is frozen. I am not sure what to do. Its at 74% and its been frozen for awhile. It has not found anything yet. Should i stop it uninstall and try again? Thanks

Report •

#16
February 6, 2009 at 10:28:48
It can sometimes be helpful when you are dealing with an infection to boot into Safe Mode and then run your antivirus/anti-malware scans from there. This is because quite a number of viruses are not set to load in Safe Mode. It will also not load the drivers for your home network or the Internet which can help keep you from being re-infected by the browser popups and redirects while trying to remove an infection.
To get to Safe Mode, repeatedly tap your F8 key on your keyboard while starting your computer. You should be able to get to a menu and then use your up or down arrow keys to select Safe Mode from the list.
Once Safe Mode is selected, tap Enter on your keyboard. (Depending on the computer, you may need to select your Operating System at the next screen and then click Enter again).
The screen will display a list of filenames that are being loaded and then eventually should come to you login screen or directly into Windows (Safe Mode). Click "yes" to continue in Safe Mode and then once fully booted, try your antivirus and anti-malware scanners again.
After the scans have been completed and they have removed what they can, simply restart the computer to get back into "normal mode" of Windows.

Earl


Report •

#17
February 6, 2009 at 15:18:57
Try this scanner.

Please run Esets online scanner from this link:

ESET

1. Note: You will need to use Internet explorer for this scan
2. Tick the box next to YES, I accept the Terms of Use.
3. Click Start
4. When asked, allow the activex control to install
5. Click Start
6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked
7. Click Scan
8. Wait for the scan to finish
9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
10. Copy and paste that log in your next reply.


Report •

#18
February 7, 2009 at 08:07:16
Hi,

I tried to run the EST scanner. I went to internet explorer, Agreed to Terms, and the yellow bar appeared at the top and I clicked on allow active x control but it never asked me to install anything and on the screen a little red x appears instead of whatever is supposed to be there.

I tried to run Kapersky in safe mode as advised and once in safe mode I could not get online to run the online scanner. Should I try Kapersky again? How can I make ESET work? Thanks

Jessica


Report •

#19
February 7, 2009 at 08:57:32
Please double-click Goored.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt).

Restart the computer then try Eset again.


Report •

#20
February 7, 2009 at 09:32:15
Here is the new Goored log:

GooredFix v1.6 by jpshortstuff
Log created at 10:25 on 07/02/2009 running Option #2
Firefox version 3.0.6 (en-US)

=====Goored Deletions=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"="C:\Documents and Settings\Buffy\Local Settings\Application Data\{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Buffy\Local Settings\Application Data\{20F7AC3B-48FE-4E19-ACD1-398E02D4A0A6}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.6\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.6\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"


Report •

#21
February 7, 2009 at 09:36:48
I think I figured out why I cant run ESET. It says "Windows has blocked this software because it cant verify the publisher. Name: Onlinescanner.cab"

Is it my firewall? I am afraid to turn my firewall off.

Jessica


Report •

#22
February 7, 2009 at 10:47:18
Disable it long enough for the scan to run then re-enable it.

Report •

#23
February 7, 2009 at 20:35:26
Still wouldnt run ESET, same message that windows blocked it, even with the firewall off. But I think its not doing it anymore--I mean I clicked on some google search results and they all came back normal. Maybe pressing 2 on goored did it? I will come back if it does it again so THANK YOU and have a nice night (or day, depending on where you are)

Report •

#24
February 8, 2009 at 08:10:22
Glad we could help.

Report •


Ask Question