Yet another Google redirect virus

July 7, 2009 at 14:44:57
Specs: Windows XP
I have used Malwarebytes and it temporarily fixed the problem.. but it has returned.. any help i could get would be great.. here are the Malware bytes and HJT logs..

Malwarebytes' Anti-Malware 1.38
Database version: 2381
Windows 5.1.2600 Service Pack 2

7/6/2009 2:06:45 PM
mbam-log-2009-07-06 (14-06-45).txt

Scan type: Quick Scan
Objects scanned: 141956
Time elapsed: 20 minute(s), 44 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
c:\WINDOWS\ld12.exe (Worm.KoobFace) -> Unloaded process successfully.
C:\WINDOWS\sysguard.exe (Trojan.Dropper) -> Unloaded process successfully.

Memory Modules Infected:
c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8567edfa-408c-43e9-b929-4c25c04f5003} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8567edfa-408c-43e9-b929-4c25c04f5003} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVDRV (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRV (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lowriskfiletypes (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\drv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\iehelper.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\ld12.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sysguard.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.
c:\WINDOWS\system32\wbem\proquota.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\documents and settings\Barbara\local settings\Temp\~TMCC.tmp (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\documents and settings\Barbara\local settings\Temp\installb[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Barbara\local settings\temporary internet files\Content.IE5\76Z90574\pp.10[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.
c:\documents and settings\Barbara\local settings\temporary internet files\Content.IE5\N7JM1YRG\pdrv[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\0101120101464849.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Program Files\drv\drv.sys (Trojan.Agent) -> Quarantined and deleted successfully.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:38:27 PM, on 7/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Barbara\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O1 - Hosts:
O1 - Hosts:
O1 - Hosts:
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: BHO - {674DE1AA-FACF-47a5-A4CF-9EF05F9A1B2A} - C:\WINDOWS\system32\iehelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TrustSoftAntiSpyware] C:\Program Files\TrustSoft AntiSpyware\TrustSoftAntiSpyware.exe /STARTUP
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DllRunning] rundll32.exe "C:\DOCUME~1\Andrew\LOCALS~1\Temp\abc123x2v9.dll",SetVM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld12.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [LowRiskFileTypes] C:\WINDOWS\sysguard.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Update Service (gupdate1c98a049f99748a) (gupdate1c98a049f99748a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

End of file - 11116 bytes

See More: Yet another Google redirect virus

Report •

July 7, 2009 at 14:57:43
Run full Scan with SuperAntispyware : . Fix what it detects and post summary scan log.

If I'm helping you and I don't reply within 24 hours send me a PM.

Report •

July 7, 2009 at 15:06:13
Running the scan now.. will post when its ready

Report •

July 7, 2009 at 16:26:39
SUPERAntiSpyware Scan Log

Generated 07/07/2009 at 07:11 PM

Application Version : 4.26.1006

Core Rules Database Version : 3977
Trace Rules Database Version: 1917

Scan type : Complete Scan
Total Scan Time : 01:07:12

Memory items scanned : 497
Memory threats detected : 1
Registry items scanned : 5628
Registry threats detected : 40
File items scanned : 25731
File threats detected : 74

[sysldtray] C:\WINDOWS\LD12.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#sysldtray [ C:\windows\ld12.exe ]


Adware.Tracking Cookie
C:\Documents and Settings\Barbara\Cookies\barbara@advertising[2].txt
C:\Documents and Settings\Barbara\Cookies\barbara@atwola[2].txt
C:\Documents and Settings\Barbara\Cookies\barbara@zedo[2].txt
C:\Documents and Settings\Barbara\Cookies\[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@trafficmp[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@atdmt[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@ar.atwola[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@doubleclick[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@at.atwola[1].txt
C:\Documents and Settings\Barbara\Cookies\barbara@specificclick[2].txt
C:\Documents and Settings\Barbara\Cookies\barbara@ar.atwola[2].txt
C:\Documents and Settings\Barbara\Cookies\barbara@ad.yieldmanager[2].txt
C:\Documents and Settings\Barbara\Cookies\barbara@specificmedia[2].txt
C:\Documents and Settings\Alex\Cookies\alex@specificclick[1].txt
C:\Documents and Settings\Alex\Cookies\alex@ar.atwola[2].txt
C:\Documents and Settings\Alex\Cookies\alex@azjmp[1].txt
C:\Documents and Settings\Alex\Cookies\alex@atdmt[2].txt
C:\Documents and Settings\Alex\Cookies\alex@advertising[2].txt
C:\Documents and Settings\Alex\Cookies\alex@doubleclick[1].txt
C:\Documents and Settings\Alex\Cookies\alex@www.rowise[1].txt
C:\Documents and Settings\Alex\Cookies\alex@ads.glispa[2].txt
C:\Documents and Settings\Alex\Cookies\alex@apmebf[2].txt
C:\Documents and Settings\Alex\Cookies\alex@atwola[1].txt
C:\Documents and Settings\Alex\Cookies\alex@adlegend[2].txt
C:\Documents and Settings\Alex\Cookies\alex@adrevolver[2].txt
C:\Documents and Settings\Alex\Cookies\alex@dist.belnk[1].txt
C:\Documents and Settings\Alex\Cookies\alex@at.atwola[1].txt
C:\Documents and Settings\Alex\Cookies\alex@belnk[1].txt
C:\Documents and Settings\Alex\Cookies\[2].txt
C:\Documents and Settings\Alex\Cookies\alex@insightexpressai[1].txt
C:\Documents and Settings\Alex\Cookies\alex@mediaplex[1].txt
C:\Documents and Settings\Alex\Cookies\alex@onlinerewardcenter[2].txt
C:\Documents and Settings\Alex\Cookies\alex@tracker.wholinked[1].txt
C:\Documents and Settings\Alex\Cookies\alex@revsci[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@ar.atwola[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@insightexpressai[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@revsci[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@adlegend[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@ads.adbrite[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@media.adrevolver[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@precisionclick[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@atdmt[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@adknowledge[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@keywordmax[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@ad.zanox[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@atwola[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@imrworldwide[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@advertising[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@doubleclick[1].txt
C:\Documents and Settings\Andrew\Cookies\andrew@interclick[2].txt
C:\Documents and Settings\Andrew\Cookies\andrew@windowsmedia[2].txt [ C:\Documents and Settings\BAnnS\Application Data\Mozilla\Firefox\Profiles\duwzxn4y.default\cookies.txt ] [ C:\Documents and Settings\BAnnS\Application Data\Mozilla\Firefox\Profiles\duwzxn4y.default\cookies.txt ] [ C:\Documents and Settings\BAnnS\Application Data\Mozilla\Firefox\Profiles\duwzxn4y.default\cookies.txt ] [ C:\Documents and Settings\BAnnS\Application Data\Mozilla\Firefox\Profiles\duwzxn4y.default\cookies.txt ] [ C:\Documents and Settings\BAnnS\Application Data\Mozilla\Firefox\Profiles\duwzxn4y.default\cookies.txt ]
C:\Documents and Settings\Kathy\Cookies\kathy@atdmt[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@questionmarket[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@doubleclick[1].txt
C:\Documents and Settings\Kathy\Cookies\kathy@partner2profit[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@adopt.euroclick[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@mediaplex[2].txt
C:\Documents and Settings\Kathy\Cookies\[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@content.yieldmanager[3].txt
C:\Documents and Settings\Kathy\Cookies\kathy@content.yieldmanager[2].txt
C:\Documents and Settings\Kathy\Cookies\kathy@ad.yieldmanager[1].txt

Trojan.Unknown Origin/System
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#DllRunning [ rundll32.exe "C:\DOCUME~1\Andrew\LOCALS~1\Temp\abc123x2v9.dll",SetVM ]


C:\Program Files\DRV


Trace.Known Threat Sources
C:\Documents and Settings\Alex\Local Settings\Temporary Internet Files\Content.IE5\AXUBULG3\DSC_0195[1].jpg
C:\Documents and Settings\Alex\Local Settings\Temporary Internet Files\Content.IE5\WXCDYX07\peace_of_mind[1].wmv

Report •

Related Solutions

July 7, 2009 at 16:29:00

Report •

July 7, 2009 at 16:36:36
Seems to be alright for now.. hopefully that took care of it but when i thought i fixed it last time it came back so who knows.. if it does ill be back i guess. you were very helpful, thanks for your time!

Report •

July 7, 2009 at 16:45:40

Report •

July 7, 2009 at 17:29:54
looks like i still am getting redirected.. ill try running that scan now

Report •

July 7, 2009 at 17:35:17
No need to do the scan. Follow:

Note: I can help you remove malware manually. Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible. First Track this topic. Then follow:

1) Can you please post your AVZ log:
Note: Run AVZ in windows normal mode. If avz.exe doesn't start, then try to rename the file avz.exe to something else and try to run it again. Make sure you have your web browser open in background before following the steps below.

i) To create the log file, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

ii) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

iii) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator.

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

ExecuteAVUpdateEx( '', 1, '','','');

Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called inside. Upload that file to and paste the link here.

Image Tutorial

2) Download and Run DDS which will create a Pseudo HJT Report as part of its log: DDS Tool Download Link. When done, DDS will open two (2) logs

   1. DDS.txt
   2. Attach.txt

Upload the logs to and paste download link in your next reply.
Note: Disable any script-blocking programs and then double-click on the DDS.scr icon to start the program. If you did not disable a script-blocker that may be part of your antimalware program, you may receive a warning from your antimalware product asking if you would like DDS.scr to run. Please allow it to do so.

If I'm helping you and I don't reply within 24 hours send me a PM.

Report •

July 8, 2009 at 06:57:20
Hey sorry for the late response.. gonna try that now.. might not be able to get back to you right away since i have work till 9pm est

Report •

July 8, 2009 at 07:11:56
doing this step by step. heres the first link.. avz log

Report •

Report •

July 8, 2009 at 07:49:38
Uninstall this "Viewpoint Manager (Remove Only)" from add/remove programs in control panel. Then follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step:

1) Run this script in AVZ like before, your computer will reboot:

SearchRootkit(true, true);
 QuarantineFile('C:\Program Files\sfx\sfx.sys','');
 QuarantineFile('c:\program files\sfx\sfx.dll','');
 DeleteFile('c:\program files\sfx\sfx.dll');
 DeleteFile('C:\Program Files\sfx\sfx.sys');

2) After reboot execute following script in AVZ:


A file called should be created in C:\. Upload that file to and Private message me download link.

Follow these steps in order numbered:

1) Download GMER:
[This version will download a randomly named file (Recommended).]

2) Disconnect from the Internet and close all running programs.

3) Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.

4) Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.

5) GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)

6) If you receive a WARNING!!! about rootkit activity and are asked to fully scan your NO.

7) Now click the Scan button. If you see a rootkit warning window, click OK.

8) When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log and upload it Post the download link to the uploaded file in your post.

9) Exit GMER and re-enable all active protection when done.

Note: Please give me the exact name of the file you downloaded in step 1 + post your log from step 8 in your next post.

If I'm helping you and I don't reply within 24 hours send me a PM.

Report •

July 9, 2009 at 06:51:42
sorry again for the slow responses.. ill do these steps tonight or tomorrow morning.. been swamped with work

Report •

July 13, 2009 at 07:00:51
Ive been trying to do this for about a day now.. I did the first part.. created the file.. but rapidshare wont take it.. says its blacklisted.. tried renaming it and same thing.. also for the second part I ran Gmer and disabled all protection.. halfway through the scan my pc shuts off and restarts randomly.. seems to happen while its scanning windows32/shell32.dll .. any advice?

Report •

July 13, 2009 at 07:49:48
Note: Run this in safe mode.

Download and run Kaspersky AVP tool:
Once you download and start the tool:

# Check below options:

    * Select all the objects/places to be scanned. 
    * Settings > Customize > Heuristic analyzer > Enable deep rootkit search

# Click Scan
# Fix what it detects
# Zip/Rar Scan log/Summary and upload it to Post download link in your next message.

Illustrated tutorial:

If I'm helping you and I don't reply within 24 hours send me a PM.

Report •

Ask Question