Security Tools and Google redirect problem [Closed]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Security Tools and Google redirect problem [Closed], And possibly Trojan.Vundo too!

Options

Panchan View Member Profile	Oct 13 2009, 08:03 PM Post #1
New Member Posts: 6 OS: Windows XP	Hi I'm Pan and I really need your help! I have the Security Tool problem as well as Google redirect problem and possibly (at least according to Malwarebytes) a Trojan.Vundo problem (Yikes!). So I followed the Malware and Spyware Cleaning Guide and for awhile it seems that Security Tool had been gone and the Google redirecting me to other websites seemed absent but after awhile the Google problem came back, and after installing COMODO I started noticing that Security Tool was self-replicating and trying to install itself again as well as modify my registry (so far I've been blocking its attempts but it's still trying). Other problems and symptoms: - Everytime I use Malwarebytes it finds 9 or 8 new infections in my computer and always deletes some of them but files such as vozizowu.dll or Trojan.Vundo.H files it tells me it will delete them on reboot but it doesn't. - I tried VundoFix to see if it removed Trohan.Vundo but it doesn't detect anything, I also tried VirtumundoBegone but it doesn't detect anything either. - Also every time I try to open any program COMODO tells me that they are trying to install global hook dibididu.dll or vozizowu.dll, that they are trying to modify a file directory on C:\Windows\System32\bikavofo. or access explorer.exe I always tell it to block these attempts because I don't know those files and from what Malwarebytes and COMODO tell me they're malicious, and I have no idea why some of my programs would even need to access explorer.exe. Anyway here's my OTL and MBAM logs (Note: OTL is not giving me Extras.txt for some reason). OTL logfile created on: 10/12/2009 9:36:25 PM - Run 5 OTL by OldTimer - Version 3.0.20.0 Folder = C:\Documents and Settings\Gaby\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 509.80 Mb Total Physical Memory \| 116.80 Mb Available Physical Memory \| 22.91% Memory free 1.22 Gb Paging File \| 0.76 Gb Available in Paging File \| 62.70% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 74.52 Gb Total Space \| 53.42 Gb Free Space \| 71.69% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: REBEL Current User Name: Gaby Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2009/10/12 00:09:52 \| 00,723,632 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe PRC - [2009/10/12 00:09:51 \| 01,799,952 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe PRC - [2009/10/11 18:10:23 \| 00,521,216 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe PRC - [2009/09/10 13:27:11 \| 00,307,704 \| ---- \| M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/07/21 14:34:33 \| 00,185,089 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009/05/13 16:48:22 \| 00,108,289 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009/03/04 12:03:01 \| 00,039,408 \| ---- \| M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009/03/02 13:08:47 \| 00,209,153 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2008/09/12 18:48:54 \| 05,119,392 \| ---- \| M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe PRC - [2008/09/12 18:46:32 \| 00,160,160 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe PRC - [2008/09/12 18:46:32 \| 00,061,856 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneBusEnum.exe PRC - [2008/04/13 17:12:19 \| 01,033,728 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2007/09/28 13:24:36 \| 00,156,976 \| ---- \| M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe PRC - [2007/09/06 15:53:40 \| 00,169,264 \| ---- \| M] (Maxtor Corporation) -- C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe PRC - [2007/03/30 18:07:12 \| 00,132,656 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\WTablet\TabUserW.exe PRC - [2007/03/30 18:06:26 \| 01,189,424 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\Tablet.exe PRC - [2006/06/27 13:43:26 \| 00,282,624 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\QuickTime\bak\qttask.exe PRC - [2005/09/22 17:42:24 \| 00,090,112 \| ---- \| M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE ========== Win32 Services (SafeList) ========== SRV - [2009/10/12 00:09:52 \| 00,723,632 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent [Auto \| Running]) SRV - [2009/10/08 18:59:43 \| 00,194,032 \| ---- \| M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [Auto \| Stopped]) SRV - [2009/07/21 14:34:33 \| 00,185,089 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto \| Running]) SRV - [2009/05/13 16:48:22 \| 00,108,289 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto \| Running]) SRV - [2008/10/31 00:08:00 \| 00,654,848 \| ---- \| M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand \| Stopped]) SRV - [2008/09/12 18:48:54 \| 05,119,392 \| ---- \| M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc [Auto \| Running]) SRV - [2008/09/12 18:48:22 \| 00,245,664 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc [On_Demand \| Stopped]) SRV - [2008/09/12 18:46:32 \| 00,061,856 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneBusEnum.exe -- (ZuneBusEnum [Auto \| Running]) SRV - [2008/07/29 21:10:04 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand \| Stopped]) SRV - [2008/07/29 19:24:50 \| 00,881,664 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown \| Stopped]) SRV - [2008/07/29 19:16:38 \| 00,132,096 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled \| Stopped]) SRV - [2008/07/25 11:17:02 \| 00,069,632 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) SRV - [2008/07/25 11:16:40 \| 00,034,312 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand \| Stopped]) SRV - [2008/07/09 13:30:34 \| 00,315,264 \| ---- \| M] (McAfee, Inc.) -- C:\Documents and Settings\Gaby\Local Settings\Temp\0068391255330716mcinst.exe -- (0068391255330716mcinstcleanup [Auto \| Stopped]) SRV - [2008/04/13 17:12:02 \| 00,038,400 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto \| Running]) SRV - [2007/09/28 13:24:36 \| 00,156,976 \| ---- \| M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe -- (Maxtor Sync Service [Auto \| Running]) SRV - [2007/03/30 18:06:26 \| 01,189,424 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\Tablet.exe -- (TabletService [Auto \| Running]) SRV - [2006/12/29 16:50:46 \| 00,072,704 \| ---- \| M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand \| Stopped]) SRV - [2006/10/18 20:05:24 \| 00,913,408 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand \| Stopped]) SRV - [2006/06/14 16:23:58 \| 00,323,584 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPodService [On_Demand \| Stopped]) SRV - [2005/04/04 00:41:10 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand \| Stopped]) SRV - [2002/09/27 12:56:20 \| 00,139,264 \| ---- \| M] (Intel® Corporation) -- c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc [On_Demand \| Stopped]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.com/ig?hl=en [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.startup.homepage: "http://www.google.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}:6.0.01 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1 FF - prefs.js..extensions.enabledItems: {D49D1E34-B159-4e5f-A93C-64638A621D91}:1.0.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.14 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/01 23:14:11 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/08 16:14:10 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/09 14:35:20 \| 00,000,000 \| ---D \| M] [2008/08/29 10:34:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Extensions [2008/08/29 10:34:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/10/12 13:49:19 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions [2009/09/03 15:58:15 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009/06/06 00:23:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions\{D49D1E34-B159-4e5f-A93C-64638A621D91} [2009/10/12 13:49:19 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/09/10 13:27:21 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2007/07/15 15:40:15 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [2009/09/10 13:27:09 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/09/10 13:27:10 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/05/01 14:02:48 \| 01,044,480 \| ---- \| M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\mozilla firefox\plugins\libdivx.dll [2009/05/12 11:46:20 \| 01,650,992 \| ---- \| M] (DivX,Inc.) -- C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2009/05/18 15:41:32 \| 00,098,304 \| ---- \| M] (DivX, Inc) -- C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2008/12/01 20:42:02 \| 00,036,864 \| ---- \| M] (Homestead Technologies, Inc.) -- C:\Program Files\mozilla firefox\plugins\nphssb.dll [2009/09/10 13:27:15 \| 00,065,528 \| ---- \| M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2005/08/09 11:42:53 \| 00,057,344 \| ---- \| M] (America Online, Inc.) -- C:\Program Files\mozilla firefox\plugins\npunagi2.dll [2009/05/01 14:02:48 \| 00,200,704 \| ---- \| M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\mozilla firefox\plugins\ssldivx.dll [2009/07/20 09:59:55 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/07/20 09:59:55 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/07/20 09:59:55 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/07/20 09:59:55 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/07/20 09:59:55 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/07/20 09:59:55 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/07/20 09:59:56 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO) O4 - HKLM..\Run: [jiziselib] C:\WINDOWS\System32\vozizowu.DLL () O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\bak\qttask.exe (Apple Computer, Inc.) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\Gaby\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1 O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll (Sun Microsystems, Inc.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (dibididu.dll) - C:\WINDOWS\System32\dibididu.dll () O20 - AppInit_DLLs: (c:\windows\system32\bulahiye.dll) - C:\WINDOWS\System32\bulahiye.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\gaduvoma.dll) - C:\WINDOWS\System32\gaduvoma.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\nojepake.dll) - C:\WINDOWS\System32\nojepake.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\fuzosoni.dll) - C:\WINDOWS\System32\fuzosoni.dll File not found O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\System32\guard32.dll (COMODO) O20 - AppInit_DLLs: (c:\windows\system32\vozizowu.dll) - C:\WINDOWS\System32\vozizowu.dll () O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O21 - SSODL: morihidow - {ea65a808-49c6-40b2-bbc5-20f63b63924f} - C:\WINDOWS\System32\fuzosoni.dll File not found O21 - SSODL: pojosazey - {c686f650-cdfb-42d6-bc4d-68f8348cf879} - C:\WINDOWS\System32\vozizowu.dll () O21 - SSODL: situliket - {bc9a8e6e-ad86-4f0f-bdc0-f6b4fa8ec662} - C:\WINDOWS\System32\fuzosoni.dll File not found O22 - SharedTaskScheduler: {bc9a8e6e-ad86-4f0f-bdc0-f6b4fa8ec662} - gahurihor - C:\WINDOWS\System32\fuzosoni.dll File not found O22 - SharedTaskScheduler: {c686f650-cdfb-42d6-bc4d-68f8348cf879} - jugezatag - C:\WINDOWS\System32\vozizowu.dll () O22 - SharedTaskScheduler: {ea65a808-49c6-40b2-bbc5-20f63b63924f} - jugezatag - C:\WINDOWS\System32\fuzosoni.dll File not found O24 - Desktop Components:0 (My Current Home Page) - About:Home O29 - HKLM SecurityProviders - (digeste.dll) - File not found O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/09/21 23:23:50 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell - "" = AutoRun O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell - "" = AutoRun O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{b58dada5-dde9-11dd-9570-000cf1dfbb03}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O34 - HKLM BootExecute: (MACHINE) - File not found O34 - HKLM BootExecute: (BootExecut) - File not found O35 - comfile [open] -- "%1" % File not found O35 - exefile [open] -- "%1" %* File not found NetSvcs: 6to4 - Service key not found. File not found NetSvcs: Ias - Service key not found. File not found NetSvcs: Iprip - Service key not found. File not found NetSvcs: Irmon - Service key not found. File not found NetSvcs: NWCWorkstation - Service key not found. File not found NetSvcs: Nwsapagent - Service key not found. File not found NetSvcs: WmdmPmSp - Service key not found. File not found NetSvcs: helpsvc - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) NetSvcs: napagent - Service key not found. File not found NetSvcs: hkmsvc - Service key not found. File not found ========== Files/Folders - Created Within 14 Days ========== [2009/10/12 00:22:45 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\22857226 [2009/10/12 00:10:06 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Comodo [2009/10/08 18:59:51 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Google Updater [2009/10/08 19:02:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller [2009/10/08 19:02:30 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Symantec [2009/10/06 00:58:43 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gaby\Application Data\vlc [2009/10/11 22:40:41 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Symantec Shared [2009/10/08 16:24:19 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Angle Interactive [2009/10/12 00:09:54 \| 00,000,000 \| ---D \| C] -- C:\Program Files\COMODO [2009/10/11 15:58:28 \| 00,000,000 \| ---D \| C] -- C:\Program Files\ERUNT [2009/10/11 20:54:40 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/10/08 16:23:51 \| 00,000,000 \| ---D \| C] -- C:\Program Files\XoftSpySE6 [2009/10/12 00:30:40 \| 00,000,000 \| ---D \| C] -- C:\VundoFix Backups [2009/10/12 00:09:58 \| 00,179,792 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\guard32.dll [2009/10/12 00:09:58 \| 00,132,296 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys [2009/10/12 00:09:58 \| 00,087,104 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys [2009/10/12 00:09:58 \| 00,025,160 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys [2009/10/12 00:01:36 \| 40,519,952 \| ---- \| C] (COMODO) -- C:\Documents and Settings\Gaby\Desktop\CIS_Setup_3.12.111745.560_XP_Vista_x32.exe [2009/10/11 20:54:46 \| 00,038,224 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/10/11 20:54:41 \| 00,019,160 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/10/11 20:33:44 \| 01,312,080 \| ---- \| C] (Malwarebytes Corporation) -- C:\Documents and Settings\Gaby\Desktop\mbam.exe [2009/10/11 18:10:22 \| 00,521,216 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe [2009/10/11 18:02:00 \| 00,472,064 \| ---- \| C] ( ) -- C:\Documents and Settings\Gaby\Desktop\RootRepeal.exe [2009/10/11 16:00:04 \| 04,045,536 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Gaby\Desktop\mbam-setup.exe [2009/10/11 15:59:29 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2009/10/11 15:57:49 \| 00,791,393 \| ---- \| C] (Lars Hederer ) -- C:\Documents and Settings\Gaby\Desktop\erunt_setup.exe [2009/10/11 15:53:27 \| 00,021,504 \| ---- \| C] (Doug Knox) -- C:\Documents and Settings\Gaby\Desktop\SysRestorePoint.exe [2009/10/11 15:23:36 \| 00,000,000 \| ---D \| C] -- C:\_OTL [2009/10/10 02:50:45 \| 00,271,872 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\TFC.exe [2009/10/08 19:25:38 \| 00,000,000 \| ---D \| C] -- C:\backups [2009/10/08 18:36:31 \| 00,401,720 \| ---- \| C] (Trend Micro Inc.) -- C:\HiJackThis.exe [2009/10/08 16:24:19 \| 00,000,000 \| ---D \| C] -- C:\ProgramData [2009/10/08 16:17:38 \| 00,000,000 \| -HSD \| C] -- C:\WINDOWS\CSC [2009/10/08 16:03:50 \| 04,276,208 \| ---- \| C] (ParetoLogic Inc.) -- C:\XoftSpySE_Setup_RW.exe [2009/10/08 16:02:14 \| 26,733,144 \| ---- \| C] (PC Tools ) -- C:\sdsetup.exe [2006/07/23 19:18:55 \| 37,518,744 \| ---- \| C] (Apple Computer, Inc. ) -- C:\Program Files\iTunesSetup.exe ========== Files - Modified Within 14 Days ========== [2009/10/12 21:39:56 \| 00,011,168 \| -H-- \| M] () -- C:\WINDOWS\System32\bikavofo [2009/10/12 21:35:09 \| 01,474,832 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\sfi.dat [2009/10/12 21:09:02 \| 00,002,422 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/10/12 21:07:31 \| 00,000,868 \| ---- \| M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/10/12 21:05:38 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/10/12 21:05:26 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/10/12 21:04:09 \| 04,300,850 \| -H-- \| M] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\IconCache.db [2009/10/12 13:51:18 \| 00,038,400 \| ---- \| M] () -- C:\WINDOWS\System32\nasijuye.dll [2009/10/12 00:11:22 \| 00,000,808 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk [2009/10/12 00:09:53 \| 00,179,792 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\guard32.dll [2009/10/12 00:09:53 \| 00,132,296 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys [2009/10/12 00:09:53 \| 00,087,104 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys [2009/10/12 00:09:53 \| 00,025,160 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys [2009/10/12 00:06:06 \| 40,519,952 \| ---- \| M] (COMODO) -- C:\Documents and Settings\Gaby\Desktop\CIS_Setup_3.12.111745.560_XP_Vista_x32.exe [2009/10/11 20:54:53 \| 00,000,696 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/11 20:53:33 \| 04,045,536 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Gaby\Desktop\mbam-setup.exe [2009/10/11 18:10:23 \| 00,521,216 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe [2009/10/11 18:02:02 \| 00,472,064 \| ---- \| M] ( ) -- C:\Documents and Settings\Gaby\Desktop\RootRepeal.exe [2009/10/11 15:58:31 \| 00,000,611 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\NTREGOPT.lnk [2009/10/11 15:58:31 \| 00,000,592 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\ERUNT.lnk [2009/10/11 15:57:49 \| 00,791,393 \| ---- \| M] (Lars Hederer ) -- C:\Documents and Settings\Gaby\Desktop\erunt_setup.exe [2009/10/11 15:54:46 \| 00,021,504 \| ---- \| M] (Doug Knox) -- C:\Documents and Settings\Gaby\Desktop\SysRestorePoint.exe [2009/10/11 15:30:02 \| 00,034,963 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\MySlowPC.co.uk Health-Check of REBEL.htm [2009/10/11 12:34:21 \| 00,000,310 \| ---- \| M] () -- C:\Documents and Settings\Gaby\My Documents\My Documents.lnk [2009/10/10 02:51:10 \| 00,271,872 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\TFC.exe [2009/10/09 12:23:00 \| 00,051,712 \| -HS- \| M] () -- C:\WINDOWS\System32\fogehile.dll [2009/10/08 18:59:24 \| 01,246,256 \| ---- \| M] () -- C:\Google Updater.exe [2009/10/08 18:36:32 \| 00,401,720 \| ---- \| M] (Trend Micro Inc.) -- C:\HiJackThis.exe [2009/10/08 16:22:20 \| 00,001,917 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2009/10/08 16:22:06 \| 00,508,472 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/10/08 16:22:06 \| 00,432,686 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/10/08 16:22:06 \| 00,067,516 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/10/08 16:07:19 \| 01,111,904 \| ---- \| M] () -- C:\Setup_Registry_Defender.exe [2009/10/08 16:03:52 \| 04,276,208 \| ---- \| M] (ParetoLogic Inc.) -- C:\XoftSpySE_Setup_RW.exe [2009/10/08 16:02:28 \| 26,733,144 \| ---- \| M] (PC Tools ) -- C:\sdsetup.exe [2009/10/08 15:39:39 \| 00,051,712 \| ---- \| M] () -- C:\WINDOWS\System32\liyobinu.dll [2009/10/06 17:58:56 \| 00,054,156 \| -H-- \| M] () -- C:\WINDOWS\QTFont.qfn [2009/10/06 00:00:42 \| 00,000,719 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk [2009/10/05 23:56:16 \| 18,527,244 \| ---- \| M] () -- C:\Documents and Settings\Gaby\My Documents\vlc-1.0.2-win32.exe ========== Files - No Company Name ========== [2009/10/12 13:51:18 \| 00,038,400 \| ---- \| C] () -- C:\WINDOWS\System32\nasijuye.dll [2009/10/12 00:12:22 \| 01,474,832 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\sfi.dat [2009/10/12 00:11:22 \| 00,000,808 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk [2009/10/11 20:54:53 \| 00,000,696 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/11 15:58:31 \| 00,000,611 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Desktop\NTREGOPT.lnk [2009/10/11 15:58:31 \| 00,000,592 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Desktop\ERUNT.lnk [2009/10/11 12:34:20 \| 00,000,310 \| ---- \| C] () -- C:\Documents and Settings\Gaby\My Documents\My Documents.lnk [2009/10/09 12:23:00 \| 00,051,712 \| -HS- \| C] () -- C:\WINDOWS\System32\fogehile.dll [2009/10/09 12:07:42 \| 00,000,868 \| ---- \| C] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/10/08 18:59:24 \| 01,246,256 \| ---- \| C] () -- C:\Google Updater.exe [2009/10/08 16:07:15 \| 01,111,904 \| ---- \| C] () -- C:\Setup_Registry_Defender.exe [2009/10/08 15:39:39 \| 00,051,712 \| ---- \| C] () -- C:\WINDOWS\System32\liyobinu.dll [2009/10/06 00:00:42 \| 00,000,719 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk [2009/10/05 23:55:37 \| 18,527,244 \| ---- \| C] () -- C:\Documents and Settings\Gaby\My Documents\vlc-1.0.2-win32.exe [2009/07/12 00:22:27 \| 00,088,064 \| ---- \| C] () -- C:\WINDOWS\System32\vozizowu.dll [2009/07/12 00:22:27 \| 00,038,400 \| ---- \| C] () -- C:\WINDOWS\System32\zunohuwu.dll [2009/07/11 12:24:34 \| 00,038,400 \| -HS- \| C] () -- C:\WINDOWS\System32\zodabuma.dll [2009/07/11 00:09:21 \| 00,088,064 \| -HS- \| C] () -- C:\WINDOWS\System32\wuhayasa.dll [2009/07/11 00:09:21 \| 00,037,888 \| -HS- \| C] () -- C:\WINDOWS\System32\haseneza.dll [2009/07/10 12:09:05 \| 00,037,888 \| -HS- \| C] () -- C:\WINDOWS\System32\himepuka.dll [2009/07/10 00:10:54 \| 00,050,688 \| -HS- \| C] () -- C:\WINDOWS\System32\vuseyiju.dll [2009/07/10 00:10:54 \| 00,050,688 \| -HS- \| C] () -- C:\WINDOWS\System32\dibididu.dll [2008/12/13 23:27:46 \| 01,647,997 \| -HS- \| C] () -- C:\WINDOWS\System32\klcaxxvj.ini [2008/10/27 01:15:24 \| 00,000,123 \| ---- \| C] () -- C:\WINDOWS\rootkitno.ini [2008/10/19 15:02:42 \| 00,000,078 \| ---- \| C] () -- C:\WINDOWS\lsoon.ini [2008/10/19 14:26:42 \| 00,075,264 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\ShLog.txt [2008/04/12 23:04:06 \| 00,000,653 \| ---- \| C] () -- C:\WINDOWS\entpack.ini [2008/03/12 02:04:57 \| 00,000,118 \| ---- \| C] () -- C:\WINDOWS\System32\MRT.INI [2006/08/01 18:32:48 \| 00,000,022 \| ---- \| C] () -- C:\WINDOWS\System32\PICSDK.ini [2006/08/01 18:31:23 \| 00,096,768 \| ---- \| C] () -- C:\WINDOWS\SlantAdj.dll [2006/08/01 18:31:23 \| 00,000,072 \| ---- \| C] () -- C:\WINDOWS\System32\epDPE.ini [2006/08/01 18:29:02 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\EPSON RX620 Installer.ini [2006/07/25 21:05:49 \| 00,001,362 \| ---- \| C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache [2006/05/03 20:15:27 \| 00,039,736 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Application Data\GDIPFONTCACHEV1.DAT [2006/01/02 18:18:17 \| 00,039,736 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2005/12/31 19:41:56 \| 00,000,029 \| ---- \| C] () -- C:\WINDOWS\atid.ini [2005/12/15 23:59:48 \| 00,000,093 \| ---- \| C] () -- C:\WINDOWS\R300.ini [2005/12/12 00:36:18 \| 00,044,544 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/12/12 00:29:39 \| 00,000,376 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2005/11/28 13:35:10 \| 04,300,850 \| -H-- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\IconCache.db [2005/11/28 13:32:11 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\Gaby\Application Data\desktop.ini [2005/09/21 16:00:04 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini [2005/09/16 15:14:36 \| 00,157,184 \| ---- \| C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2004/08/04 05:00:00 \| 00,000,559 \| ---- \| C] () -- C:\WINDOWS\win.ini [2004/08/04 05:00:00 \| 00,000,231 \| ---- \| C] () -- C:\WINDOWS\system.ini [2002/10/07 19:15:36 \| 00,016,384 \| ---- \| C] () -- C:\WINDOWS\System32\e100bmsg.dll ========== LOP Check ========== [2009/10/12 00:22:45 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\All Users\Application Data [2009/10/12 00:25:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\22857226 [2009/01/09 23:45:16 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\acccore [2009/01/08 18:30:19 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Maxtor [2009/10/08 19:02:24 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller [2009/10/11 16:31:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2009/10/09 14:35:20 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2007/02/02 21:13:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar [2009/10/11 16:31:47 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\Gaby\Application Data [2008/12/15 21:46:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\.clamwin [2009/01/10 00:01:26 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\acccore [2006/08/02 12:41:55 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\EPSON [2009/09/15 00:29:44 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\Globe7 [2005/12/16 00:17:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\Leadertech [2009/06/06 00:24:01 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\MRTalk [2009/04/12 21:05:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\Opera [2008/10/19 14:26:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\Regrun [2009/10/12 14:05:11 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\U3 [2009/10/12 21:07:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\WTablet [2004/08/04 05:00:00 \| 00,000,065 \| RH-- \| M] () -- C:\WINDOWS\Tasks\desktop.ini [2009/10/12 21:07:31 \| 00,000,868 \| ---- \| M] () -- C:\WINDOWS\Tasks\Google Software Updater.job [2009/10/12 21:05:38 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\Tasks\SA.DAT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > [2007/07/15 15:35:21 \| 00,591,400 \| ---- \| M] (McAfee, Inc.) -- C:\DMSetup.exe [2006/07/12 22:45:44 \| 05,118,288 \| ---- \| M] (Mozilla) -- C:\Firefox Setup 1.5.0.4.exe [2009/10/08 18:59:24 \| 01,246,256 \| ---- \| M] () -- C:\Google Updater.exe [2009/10/08 18:36:32 \| 00,401,720 \| ---- \| M] (Trend Micro Inc.) -- C:\HiJackThis.exe [2008/11/26 00:42:30 \| 01,851,544 \| ---- \| M] (Adobe Systems Incorporated) -- C:\install_flash_player.exe [2009/10/08 16:02:28 \| 26,733,144 \| ---- \| M] (PC Tools ) -- C:\sdsetup.exe [2009/10/08 16:07:19 \| 01,111,904 \| ---- \| M] () -- C:\Setup_Registry_Defender.exe [2005/10/31 08:56:00 \| 00,700,416 \| ---- \| M] (LimeWire) -- C:\StubInstaller.exe [2009/10/08 16:03:52 \| 04,276,208 \| ---- \| M] (ParetoLogic Inc.) -- C:\XoftSpySE_Setup_RW.exe < %systemroot%\system32\eventlog.dll > [2008/04/13 17:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\eventlog.dll < %systemroot%\system32\scecli.dll > [2008/04/13 17:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\system32\scecli.dll < %systemroot%\netlogon.dll > < %systemroot%\system32\cngaudit.dll > < %systemroot%\system32\sceclt.dll > < %systemroot%\ntelogon.dll > < %systemroot%\system32\logevent.dll > ========== Alternate Data Streams ========== @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 < End of report > ----- Malwarebytes' Anti-Malware 1.41 Database version: 2775 Windows 5.1.2600 Service Pack 3 10/12/2009 9:03:35 PM mbam-log-2009-10-12 (21-03-35).txt Scan type: Quick Scan Objects scanned: 112541 Time elapsed: 9 minute(s), 44 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 1 Registry Values Infected: 3 Registry Data Items Infected: 3 Folders Infected: 1 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: c:\WINDOWS\system32\vozizowu.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{c686f650-cdfb-42d6-bc4d-68f8348cf879} (Trojan.Vundo.H) -> Delete on reboot. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiziselib (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c686f650-cdfb-42d6-bc4d-68f8348cf879} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\pojosazey (Trojan.Vundo.H) -> Delete on reboot. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vozizowu.dll -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vozizowu.dll -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\22857226 (Rogue.Multiple) -> Delete on reboot. Files Infected: c:\WINDOWS\system32\vozizowu.dll (Trojan.Vundo.H) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\22857226\22857226.exe (Rogue.Multiple) -> Delete on reboot. C:\WINDOWS\system32\nasijuye.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\zunohuwu.dll (Trojan.Vundo) -> Delete on reboot. --- I apologize for the long post since I don't want to do an attachment in fear of possibly spreading this thing.

heir View Member Profile	Oct 14 2009, 03:15 AM Post #2
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	Hello Panchan ! Welcome to the site! My nickname is heir and I'll be helping clean up your computer. Before we proceed to clean your computer from malware, let's go over some points that will help both me and you, and prevent causing damage to your computer: To make sure that you receive an email when I reply to this topic, please click here and check that this topic is listed under Malware Removal and Spyware Removal. Please don't be afraid to ask questions! No question is considered dumb here. It's better to be safe than sorry! When posting logs, please ensure Wordwrap is turned off in Notepad (to check, open Notepad in the menubar click on Format and make sure that Word Wrap is unchecked) Please follow the steps exactly in the same order posted. If you can't perform a certain step, or you're unsure on what to do, please stop and let me know. NEVER fix anything with the tools on your own! This can be very dangerous and cause harm to your system. If you see a certain entry or program you're unsure about, please don't hesitate to ask! Make sure you reply to this thread using the Add Reply button: Please read my posts completely before following the instructions. It may be easier for you if you copy and paste a post to a new text document or print it for reference later. This is required when you won't have access to Internet. Step 1. OTL-fix: Run OTL.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [jiziselib] C:\WINDOWS\System32\vozizowu.DLL () O20 - AppInit_DLLs: (dibididu.dll) - C:\WINDOWS\System32\dibididu.dll () O20 - AppInit_DLLs: (c:\windows\system32\bulahiye.dll) - C:\WINDOWS\System32\bulahiye.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\gaduvoma.dll) - C:\WINDOWS\System32\gaduvoma.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\nojepake.dll) - C:\WINDOWS\System32\nojepake.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\fuzosoni.dll) - C:\WINDOWS\System32\fuzosoni.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\vozizowu.dll) - C:\WINDOWS\System32\vozizowu.dll () O21 - SSODL: morihidow - {ea65a808-49c6-40b2-bbc5-20f63b63924f} - C:\WINDOWS\System32\fuzosoni.dll File not found O21 - SSODL: pojosazey - {c686f650-cdfb-42d6-bc4d-68f8348cf879} - C:\WINDOWS\System32\vozizowu.dll () O21 - SSODL: situliket - {bc9a8e6e-ad86-4f0f-bdc0-f6b4fa8ec662} - C:\WINDOWS\System32\fuzosoni.dll File not found O22 - SharedTaskScheduler: {bc9a8e6e-ad86-4f0f-bdc0-f6b4fa8ec662} - gahurihor - C:\WINDOWS\System32\fuzosoni.dll File not found O22 - SharedTaskScheduler: {c686f650-cdfb-42d6-bc4d-68f8348cf879} - jugezatag - C:\WINDOWS\System32\vozizowu.dll () O22 - SharedTaskScheduler: {ea65a808-49c6-40b2-bbc5-20f63b63924f} - jugezatag - C:\WINDOWS\System32\fuzosoni.dll File not found O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell - "" = AutoRun O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2ce2d830-6d1f-11dc-92a4-000cf1dfbb03}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell - "" = AutoRun O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{923f78ee-7935-11dd-94a2-000cf1dfbb03}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{b58dada5-dde9-11dd-9570-000cf1dfbb03}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found [2009/10/12 21:39:56 \| 00,011,168 \| -H-- \| M] () -- C:\WINDOWS\System32\bikavofo [2009/10/12 13:51:18 \| 00,038,400 \| ---- \| M] () -- C:\WINDOWS\System32\nasijuye.dll [2009/10/09 12:23:00 \| 00,051,712 \| -HS- \| M] () -- C:\WINDOWS\System32\fogehile.dll [2009/10/08 15:39:39 \| 00,051,712 \| ---- \| M] () -- C:\WINDOWS\System32\liyobinu.dll [2009/07/12 00:22:27 \| 00,088,064 \| ---- \| C] () -- C:\WINDOWS\System32\vozizowu.dll [2009/07/12 00:22:27 \| 00,038,400 \| ---- \| C] () -- C:\WINDOWS\System32\zunohuwu.dll [2009/07/11 12:24:34 \| 00,038,400 \| -HS- \| C] () -- C:\WINDOWS\System32\zodabuma.dll [2009/07/11 00:09:21 \| 00,088,064 \| -HS- \| C] () -- C:\WINDOWS\System32\wuhayasa.dll [2009/07/11 00:09:21 \| 00,037,888 \| -HS- \| C] () -- C:\WINDOWS\System32\haseneza.dll [2009/07/10 12:09:05 \| 00,037,888 \| -HS- \| C] () -- C:\WINDOWS\System32\himepuka.dll [2009/07/10 00:10:54 \| 00,050,688 \| -HS- \| C] () -- C:\WINDOWS\System32\vuseyiju.dll [2009/07/10 00:10:54 \| 00,050,688 \| -HS- \| C] () -- C:\WINDOWS\System32\dibididu.dll [2008/12/13 23:27:46 \| 01,647,997 \| -HS- \| C] () -- C:\WINDOWS\System32\klcaxxvj.ini :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Then post the OTL fixlog Step 2. Lop S&D: Disable resident protections (Antivirus...); you'll re-enable them after the scan Download Lop S&D < here and save it to the desktop Double-click Lop S&D.exe Choose the language, then choose Option 1 (Search) Wait till the end of the scan Post the log which is created: (%SystemDrive%\lopR.txt) Step 3. OTL-scan: Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Standard Output. Underneath Extra Registry at the top change it to Use SafeList. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in. Step 4. Things I would like to see in your reply: The content of the fixlog from OTL in step 1. The content of C:\lopR.txt from step 2. The content of OTL.txt and Extras.txt from step 3. Information on how your computer is running now.

heir View Member Profile	Oct 15 2009, 12:31 AM Post #4
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	It respawned Let's do one more sweep. Step 1. OTL-fix: Run OTL.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) O4 - HKLM..\Run: [jiziselib] C:\WINDOWS\System32\wuhayasa.DLL File not found O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [sovarunizu] File not found O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found O20 - AppInit_DLLs: (c:\windows\system32\vozizowu.dll) - C:\WINDOWS\System32\vozizowu.dll File not found O20 - AppInit_DLLs: (dibididu.dll) - File not found O20 - AppInit_DLLs: (c:\windows\system32\wuhayasa.dll) - C:\WINDOWS\System32\wuhayasa.dll File not found O21 - SSODL: pojosazey - {c686f650-cdfb-42d6-bc4d-68f8348cf879} - C:\WINDOWS\System32\wuhayasa.dll File not found O22 - SharedTaskScheduler: {c686f650-cdfb-42d6-bc4d-68f8348cf879} - jugezatag - C:\WINDOWS\System32\wuhayasa.dll File not found [2009/10/12 00:22:45 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\22857226 [2009/10/14 13:50:09 \| 00,001,744 \| -H-- \| M] () -- C:\WINDOWS\System32\bikavofo [2009/10/13 17:33:59 \| 00,088,576 \| -HS- \| M] () -- C:\WINDOWS\System32\loyuvejo.dll [2009/10/13 17:33:59 \| 00,050,688 \| -HS- \| M] () -- C:\WINDOWS\System32\robejaku.dll [2009/10/13 17:31:59 \| 00,037,888 \| ---- \| M] () -- C:\WINDOWS\System32\zurufalo.dll :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\LimeWire\LimeWire.exe"=- :Files C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint C:\Program Files\LimeWire C:\Program Files\Viewpoint C:\Program Files\Common Files\Viewpoint :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done Then post the OTL fixlog Step 2. MBAM: Run MBAM and let it remove what it finds. Post the content of the report in your reply. Step 3. OTL-scan: Run a scan with OTL and post the content of the log (OTL.txt) in your reply Step 4. Things I would like to see in your reply: The content of the fixlog from OTL in step 1. The content of the report from MBAM in step 2. The content of OTL.txt in step 3. Information on how your computer is running now.

Panchan View Member Profile	Oct 15 2009, 07:59 PM Post #5
New Member Posts: 6 OS: Windows XP	Fixlog from OTL All processes killed ========== OTL ========== Process explorer.exe killed successfully! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\jiziselib deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sovarunizu deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\Flags deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\vozizowu.dll deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:dibididu.dll deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\wuhayasa.dll deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\pojosazey deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c686f650-cdfb-42d6-bc4d-68f8348cf879}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{c686f650-cdfb-42d6-bc4d-68f8348cf879} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c686f650-cdfb-42d6-bc4d-68f8348cf879}\ not found. C:\Documents and Settings\All Users\Application Data\22857226 moved successfully. C:\WINDOWS\System32\bikavofo moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\loyuvejo.dll C:\WINDOWS\System32\loyuvejo.dll NOT unregistered. C:\WINDOWS\System32\loyuvejo.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\robejaku.dll C:\WINDOWS\System32\robejaku.dll NOT unregistered. C:\WINDOWS\System32\robejaku.dll moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\System32\zurufalo.dll C:\WINDOWS\System32\zurufalo.dll NOT unregistered. C:\WINDOWS\System32\zurufalo.dll moved successfully. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\LimeWire\LimeWire.exe deleted successfully. ========== FILES ========== C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Viewpoint Toolbar moved successfully. C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\Toolbar Runtime moved successfully. C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint\AxMetaStream_Win moved successfully. C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint moved successfully. C:\Program Files\LimeWire moved successfully. C:\Program Files\Viewpoint\Viewpoint Toolbar moved successfully. C:\Program Files\Viewpoint moved successfully. C:\Program Files\Common Files\Viewpoint\Toolbar Runtime moved successfully. C:\Program Files\Common Files\Viewpoint moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Alma Rosa ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Gaby File delete failed. C:\Documents and Settings\Gaby\Local Settings\Temp\etilqs_5T0TQlTIvUJ3XtwAlfGa scheduled to be deleted on reboot. ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\Gaby\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 196809 bytes ->Java cache emptied: 0 bytes File delete failed. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\urlclassifier3.sqlite scheduled to be deleted on reboot. ->FireFox cache emptied: 36532178 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 36979687 bytes RecycleBin emptied: 171664 bytes Total Files Cleaned = 70.52 mb OTL by OldTimer - Version 3.0.20.0 log created on 10152009_175626 Files\Folders moved on Reboot... File\Folder C:\Documents and Settings\Gaby\Local Settings\Temp\etilqs_5T0TQlTIvUJ3XtwAlfGa not found! C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Gaby\Local Settings\Application Data\Mozilla\Firefox\Profiles\qqyc5hie.default\urlclassifier3.sqlite moved successfully. Registry entries deleted on Reboot... ---- MBAM Log Malwarebytes' Anti-Malware 1.41 Database version: 2775 Windows 5.1.2600 Service Pack 3 10/15/2009 6:09:55 PM mbam-log-2009-10-15 (18-09-55).txt Scan type: Quick Scan Objects scanned: 112123 Time elapsed: 5 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiziselib (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sovarunizu (Trojan.Agent) -> Delete on reboot. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) --- Last OTL log OTL logfile created on: 10/15/2009 6:47:55 PM - Run 7 OTL by OldTimer - Version 3.0.20.0 Folder = C:\Documents and Settings\Gaby\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 509.80 Mb Total Physical Memory \| 304.37 Mb Available Physical Memory \| 59.70% Memory free 1.22 Gb Paging File \| 0.82 Gb Available in Paging File \| 67.01% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 74.52 Gb Total Space \| 53.42 Gb Free Space \| 71.68% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: REBEL Current User Name: Gaby Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2009/10/12 00:09:52 \| 00,723,632 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe PRC - [2009/10/12 00:09:51 \| 01,799,952 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe PRC - [2009/10/11 18:10:23 \| 00,521,216 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe PRC - [2009/09/10 13:27:11 \| 00,307,704 \| ---- \| M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009/07/21 14:34:33 \| 00,185,089 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009/05/13 16:48:22 \| 00,108,289 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009/03/04 12:03:01 \| 00,039,408 \| ---- \| M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PRC - [2009/03/02 13:08:47 \| 00,209,153 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2008/09/12 18:48:54 \| 05,119,392 \| ---- \| M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe PRC - [2008/09/12 18:46:32 \| 00,160,160 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe PRC - [2008/09/12 18:46:32 \| 00,061,856 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneBusEnum.exe PRC - [2008/04/13 17:12:19 \| 01,033,728 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2007/09/28 13:24:36 \| 00,156,976 \| ---- \| M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe PRC - [2007/09/06 15:53:40 \| 00,169,264 \| ---- \| M] (Maxtor Corporation) -- C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe PRC - [2007/03/30 18:07:12 \| 00,132,656 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\WTablet\TabUserW.exe PRC - [2007/03/30 18:06:26 \| 01,189,424 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\Tablet.exe PRC - [2006/06/27 13:43:26 \| 00,282,624 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\QuickTime\bak\qttask.exe PRC - [2005/09/22 17:42:24 \| 00,090,112 \| ---- \| M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE ========== Win32 Services (SafeList) ========== SRV - File not found -- -- (0068391255330716mcinstcleanup [Auto \| Stopped]) SRV - [2009/10/12 00:09:52 \| 00,723,632 \| ---- \| M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent [Auto \| Running]) SRV - [2009/10/08 18:59:43 \| 00,194,032 \| ---- \| M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [Auto \| Stopped]) SRV - [2009/07/21 14:34:33 \| 00,185,089 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto \| Running]) SRV - [2009/05/13 16:48:22 \| 00,108,289 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto \| Running]) SRV - [2008/10/31 00:08:00 \| 00,654,848 \| ---- \| M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand \| Stopped]) SRV - [2008/09/12 18:48:54 \| 05,119,392 \| ---- \| M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc [Auto \| Running]) SRV - [2008/09/12 18:48:22 \| 00,245,664 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc [On_Demand \| Stopped]) SRV - [2008/09/12 18:46:32 \| 00,061,856 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\ZuneBusEnum.exe -- (ZuneBusEnum [Auto \| Running]) SRV - [2008/07/29 21:10:04 \| 00,046,104 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand \| Stopped]) SRV - [2008/07/29 19:24:50 \| 00,881,664 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown \| Stopped]) SRV - [2008/07/29 19:16:38 \| 00,132,096 \| ---- \| M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled \| Stopped]) SRV - [2008/07/25 11:17:02 \| 00,069,632 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) SRV - [2008/07/25 11:16:40 \| 00,034,312 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand \| Stopped]) SRV - [2008/04/13 17:12:02 \| 00,038,400 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto \| Running]) SRV - [2007/09/28 13:24:36 \| 00,156,976 \| ---- \| M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe -- (Maxtor Sync Service [Auto \| Running]) SRV - [2007/03/30 18:06:26 \| 01,189,424 \| ---- \| M] (Wacom Technology, Corp.) -- C:\WINDOWS\System32\Tablet.exe -- (TabletService [Auto \| Running]) SRV - [2006/12/29 16:50:46 \| 00,072,704 \| ---- \| M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand \| Stopped]) SRV - [2006/10/18 20:05:24 \| 00,913,408 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand \| Stopped]) SRV - [2006/06/14 16:23:58 \| 00,323,584 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPodService [On_Demand \| Stopped]) SRV - [2005/04/04 00:41:10 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand \| Stopped]) SRV - [2002/09/27 12:56:20 \| 00,139,264 \| ---- \| M] (Intel® Corporation) -- c:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc [On_Demand \| Stopped]) ========== Driver Services (SafeList) ========== DRV - [2009/10/12 00:09:53 \| 00,132,296 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\DRIVERS\cmdguard.sys -- (cmdGuard [System \| Running]) DRV - [2009/10/12 00:09:53 \| 00,087,104 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\DRIVERS\inspect.sys -- (Inspect [Boot \| Running]) DRV - [2009/10/12 00:09:53 \| 00,025,160 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\DRIVERS\cmdhlp.sys -- (cmdHlp [System \| Running]) DRV - [2009/07/28 16:33:56 \| 00,055,656 \| ---- \| M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto \| Running]) DRV - [2009/05/11 10:12:24 \| 00,028,520 \| ---- \| M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System \| Running]) DRV - [2009/03/30 10:33:07 \| 00,096,104 \| ---- \| M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System \| Running]) DRV - [2009/02/13 12:35:05 \| 00,011,608 \| ---- \| M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System \| Running]) DRV - [2008/10/21 20:29:22 \| 00,011,609 \| ---- \| M] () -- C:\WINDOWS\Partizan.txt -- (Partizan [Boot \| Stopped]) DRV - [2008/10/17 23:45:25 \| 00,102,664 \| ---- \| M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys -- (tmcomm [Auto \| Running]) DRV - [2008/09/15 17:14:18 \| 00,043,528 \| ---- \| M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot \| Running]) DRV - [2008/09/12 18:32:04 \| 00,040,832 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\zumbus.sys -- (zumbus [Auto \| Running]) DRV - [2007/11/13 03:25:53 \| 00,020,480 \| ---- \| M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand \| Stopped]) DRV - [2007/05/03 14:37:08 \| 00,022,152 \| ---- \| M] (Maxtor Corp.) -- C:\WINDOWS\System32\DRIVERS\mxopswd.sys -- (MXOPSWD [On_Demand \| Stopped]) DRV - [2007/02/16 12:12:36 \| 00,011,312 \| ---- \| M] (Wacom Technology) -- C:\WINDOWS\System32\DRIVERS\wacommousefilter.sys -- (wacommousefilter [On_Demand \| Running]) DRV - [2007/02/16 11:30:12 \| 00,012,848 \| ---- \| M] (Wacom Technology) -- C:\WINDOWS\System32\DRIVERS\wacomvhid.sys -- (wacomvhid [On_Demand \| Running]) DRV - [2005/09/22 17:34:18 \| 03,727,680 \| ---- \| M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand \| Running]) DRV - [2005/02/02 01:21:04 \| 00,014,408 \| ---- \| M] (GEAR Software Inc.) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand \| Running]) DRV - [2004/08/04 05:00:00 \| 00,017,792 \| ---- \| M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand \| Running]) DRV - [2004/02/10 12:17:06 \| 00,681,469 \| ---- \| M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys -- (ialm [On_Demand \| Running]) DRV - [2002/10/16 01:11:22 \| 00,019,968 \| ---- \| M] (Intel Corporation ) -- C:\WINDOWS\System32\Drivers\iqvw32.sys -- (NAL [On_Demand \| Stopped]) DRV - [2002/10/15 01:00:00 \| 00,101,431 \| ---- \| M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\IdeChnDr.sys -- (IdeChnDr [Boot \| Running]) DRV - [2002/10/15 01:00:00 \| 00,013,891 \| ---- \| M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\IdeBusDr.sys -- (IdeBusDr [Boot \| Running]) DRV - [2002/09/25 07:09:12 \| 00,140,800 \| ---- \| M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand \| Running]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.com/ig?hl=en [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.startup.homepage: "http://www.google.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}:6.0.01 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1 FF - prefs.js..extensions.enabledItems: {D49D1E34-B159-4e5f-A93C-64638A621D91}:1.0.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.14 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/01 23:14:11 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/08 16:14:10 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/09 14:35:20 \| 00,000,000 \| ---D \| M] [2008/08/29 10:34:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Extensions [2008/08/29 10:34:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/10/15 18:38:54 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions [2009/09/03 15:58:15 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009/06/06 00:23:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Gaby\Application Data\mozilla\Firefox\Profiles\qqyc5hie.default\extensions\{D49D1E34-B159-4e5f-A93C-64638A621D91} [2009/10/15 18:38:54 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/09/10 13:27:21 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2007/07/15 15:40:15 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} [2009/09/10 13:27:09 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/09/10 13:27:10 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/05/01 14:02:48 \| 01,044,480 \| ---- \| M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\mozilla firefox\plugins\libdivx.dll [2009/05/12 11:46:20 \| 01,650,992 \| ---- \| M] (DivX,Inc.) -- C:\Program Files\mozilla firefox\plugins\npdivx32.dll [2009/05/18 15:41:32 \| 00,098,304 \| ---- \| M] (DivX, Inc) -- C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2008/12/01 20:42:02 \| 00,036,864 \| ---- \| M] (Homestead Technologies, Inc.) -- C:\Program Files\mozilla firefox\plugins\nphssb.dll [2009/09/10 13:27:15 \| 00,065,528 \| ---- \| M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2006/07/23 19:25:26 \| 00,126,976 \| ---- \| M] (Apple Computer, Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2005/08/09 11:42:53 \| 00,057,344 \| ---- \| M] (America Online, Inc.) -- C:\Program Files\mozilla firefox\plugins\npunagi2.dll [2009/05/01 14:02:48 \| 00,200,704 \| ---- \| M] (The OpenSSL Project, http://www.openssl.org/) -- C:\Program Files\mozilla firefox\plugins\ssldivx.dll [2009/07/20 09:59:55 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/07/20 09:59:55 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/07/20 09:59:55 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/07/20 09:59:55 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/07/20 09:59:55 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/07/20 09:59:55 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/07/20 09:59:56 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO) O4 - HKLM..\Run: [jiziselib] C:\WINDOWS\System32\loyuvejo.DLL File not found O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\bak\qttask.exe (Apple Computer, Inc.) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [sovarunizu] File not found O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\Gaby\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1 O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll (Sun Microsystems, Inc.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_01) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (c:\windows\system32\guard32.dll) - C:\WINDOWS\System32\guard32.dll (COMODO) O20 - AppInit_DLLs: (c:\windows\system32\vozizowu.dll) - C:\WINDOWS\System32\vozizowu.dll File not found O20 - AppInit_DLLs: (dibididu.dll) - File not found O20 - AppInit_DLLs: (c:\windows\system32\wuhayasa.dll) - C:\WINDOWS\System32\wuhayasa.dll File not found O20 - AppInit_DLLs: (c:\windows\system32\loyuvejo.dll) - C:\WINDOWS\System32\loyuvejo.dll File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O21 - SSODL: vutenejol - {eb5095e7-0289-4358-9aa0-093e3e174a90} - C:\WINDOWS\System32\loyuvejo.dll File not found O22 - SharedTaskScheduler: {eb5095e7-0289-4358-9aa0-093e3e174a90} - kupuhivus - C:\WINDOWS\System32\loyuvejo.dll File not found O24 - Desktop Components:0 (My Current Home Page) - About:Home O29 - HKLM SecurityProviders - (digeste.dll) - File not found O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/09/21 23:23:50 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O34 - HKLM BootExecute: (MACHINE) - File not found O34 - HKLM BootExecute: (BootExecut) - File not found O35 - comfile [open] -- "%1" % File not found O35 - exefile [open] -- "%1" %* File not found ========== Files/Folders - Created Within 30 Days ========== [2009/10/12 00:10:06 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Comodo [2009/10/08 18:59:51 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Google Updater [2009/10/08 19:02:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller [2009/10/08 19:02:30 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Symantec [2009/10/06 00:58:43 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Gaby\Application Data\vlc [2009/10/11 22:40:41 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Symantec Shared [2009/10/08 16:24:19 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Angle Interactive [2009/10/12 00:09:54 \| 00,000,000 \| ---D \| C] -- C:\Program Files\COMODO [2009/10/11 15:58:28 \| 00,000,000 \| ---D \| C] -- C:\Program Files\ERUNT [2009/10/11 20:54:40 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/10/08 16:23:51 \| 00,000,000 \| ---D \| C] -- C:\Program Files\XoftSpySE6 [2009/10/14 13:58:12 \| 00,000,000 \| ---D \| C] -- C:\Lop SD [2009/10/12 14:06:40 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll [2009/10/12 14:06:40 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hidserv.dll [2009/10/12 00:30:40 \| 00,000,000 \| ---D \| C] -- C:\VundoFix Backups [2009/10/12 00:30:08 \| 00,119,808 \| ---- \| C] (Atribune.org) -- C:\Documents and Settings\Gaby\Desktop\VundoFix.exe [2009/10/12 00:09:58 \| 00,179,792 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\guard32.dll [2009/10/12 00:09:58 \| 00,132,296 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys [2009/10/12 00:09:58 \| 00,087,104 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys [2009/10/12 00:09:58 \| 00,025,160 \| ---- \| C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys [2009/10/12 00:01:36 \| 40,519,952 \| ---- \| C] (COMODO) -- C:\Documents and Settings\Gaby\Desktop\CIS_Setup_3.12.111745.560_XP_Vista_x32.exe [2009/10/11 20:54:46 \| 00,038,224 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/10/11 20:54:41 \| 00,019,160 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/10/11 20:33:44 \| 01,312,080 \| ---- \| C] (Malwarebytes Corporation) -- C:\Documents and Settings\Gaby\Desktop\mbam.exe [2009/10/11 18:10:22 \| 00,521,216 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe [2009/10/11 18:02:00 \| 00,472,064 \| ---- \| C] ( ) -- C:\Documents and Settings\Gaby\Desktop\RootRepeal.exe [2009/10/11 16:00:04 \| 04,045,536 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Gaby\Desktop\mbam-setup.exe [2009/10/11 15:59:29 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2009/10/11 15:57:49 \| 00,791,393 \| ---- \| C] (Lars Hederer ) -- C:\Documents and Settings\Gaby\Desktop\erunt_setup.exe [2009/10/11 15:53:27 \| 00,021,504 \| ---- \| C] (Doug Knox) -- C:\Documents and Settings\Gaby\Desktop\SysRestorePoint.exe [2009/10/11 15:23:36 \| 00,000,000 \| ---D \| C] -- C:\_OTL [2009/10/10 02:50:45 \| 00,271,872 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\TFC.exe [2009/10/08 19:25:38 \| 00,000,000 \| ---D \| C] -- C:\backups [2009/10/08 18:36:31 \| 00,401,720 \| ---- \| C] (Trend Micro Inc.) -- C:\HiJackThis.exe [2009/10/08 16:24:19 \| 00,000,000 \| ---D \| C] -- C:\ProgramData [2009/10/08 16:17:38 \| 00,000,000 \| -HSD \| C] -- C:\WINDOWS\CSC [2009/10/08 16:03:50 \| 04,276,208 \| ---- \| C] (ParetoLogic Inc.) -- C:\XoftSpySE_Setup_RW.exe [2009/10/08 16:02:14 \| 26,733,144 \| ---- \| C] (PC Tools ) -- C:\sdsetup.exe [2006/07/23 19:18:55 \| 37,518,744 \| ---- \| C] (Apple Computer, Inc. ) -- C:\Program Files\iTunesSetup.exe ========== Files - Modified Within 30 Days ========== [2009/10/15 18:51:16 \| 01,474,832 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\sfi.dat [2009/10/15 18:12:35 \| 00,002,422 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/10/15 18:12:01 \| 00,000,868 \| ---- \| M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/10/15 18:11:39 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/10/15 18:11:30 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/10/15 18:10:19 \| 04,829,526 \| -H-- \| M] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\IconCache.db [2009/10/15 17:57:55 \| 00,001,744 \| -H-- \| M] () -- C:\WINDOWS\System32\bikavofo [2009/10/14 13:57:52 \| 00,501,736 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\LopSD.exe [2009/10/13 18:08:43 \| 00,053,753 \| ---- \| M] () -- C:\Scanplumon.jpg [2009/10/13 17:57:18 \| 00,080,094 \| ---- \| M] () -- C:\ScanScan.jpg [2009/10/12 00:30:12 \| 00,119,808 \| ---- \| M] (Atribune.org) -- C:\Documents and Settings\Gaby\Desktop\VundoFix.exe [2009/10/12 00:11:22 \| 00,000,808 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk [2009/10/12 00:09:53 \| 00,179,792 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\guard32.dll [2009/10/12 00:09:53 \| 00,132,296 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys [2009/10/12 00:09:53 \| 00,087,104 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys [2009/10/12 00:09:53 \| 00,025,160 \| ---- \| M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys [2009/10/12 00:06:06 \| 40,519,952 \| ---- \| M] (COMODO) -- C:\Documents and Settings\Gaby\Desktop\CIS_Setup_3.12.111745.560_XP_Vista_x32.exe [2009/10/11 20:54:53 \| 00,000,696 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/11 20:53:33 \| 04,045,536 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Gaby\Desktop\mbam-setup.exe [2009/10/11 18:10:23 \| 00,521,216 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\OTL.exe [2009/10/11 18:02:02 \| 00,472,064 \| ---- \| M] ( ) -- C:\Documents and Settings\Gaby\Desktop\RootRepeal.exe [2009/10/11 15:58:31 \| 00,000,611 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\NTREGOPT.lnk [2009/10/11 15:58:31 \| 00,000,592 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\ERUNT.lnk [2009/10/11 15:57:49 \| 00,791,393 \| ---- \| M] (Lars Hederer ) -- C:\Documents and Settings\Gaby\Desktop\erunt_setup.exe [2009/10/11 15:54:46 \| 00,021,504 \| ---- \| M] (Doug Knox) -- C:\Documents and Settings\Gaby\Desktop\SysRestorePoint.exe [2009/10/11 15:30:02 \| 00,034,963 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\MySlowPC.co.uk Health-Check of REBEL.htm [2009/10/11 12:34:21 \| 00,000,310 \| ---- \| M] () -- C:\Documents and Settings\Gaby\My Documents\My Documents.lnk [2009/10/10 02:51:10 \| 00,271,872 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Gaby\Desktop\TFC.exe [2009/10/08 18:59:24 \| 01,246,256 \| ---- \| M] () -- C:\Google Updater.exe [2009/10/08 18:36:32 \| 00,401,720 \| ---- \| M] (Trend Micro Inc.) -- C:\HiJackThis.exe [2009/10/08 16:22:20 \| 00,001,917 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2009/10/08 16:22:06 \| 00,508,472 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/10/08 16:22:06 \| 00,432,686 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/10/08 16:22:06 \| 00,067,516 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/10/08 16:07:19 \| 01,111,904 \| ---- \| M] () -- C:\Setup_Registry_Defender.exe [2009/10/08 16:03:52 \| 04,276,208 \| ---- \| M] (ParetoLogic Inc.) -- C:\XoftSpySE_Setup_RW.exe [2009/10/08 16:02:28 \| 26,733,144 \| ---- \| M] (PC Tools ) -- C:\sdsetup.exe [2009/10/06 17:58:56 \| 00,054,156 \| -H-- \| M] () -- C:\WINDOWS\QTFont.qfn [2009/10/06 00:00:42 \| 00,000,719 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk [2009/10/05 23:56:16 \| 18,527,244 \| ---- \| M] () -- C:\Documents and Settings\Gaby\My Documents\vlc-1.0.2-win32.exe [2009/09/22 01:56:29 \| 00,044,544 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/09/20 22:12:53 \| 00,000,795 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\DivX Player.lnk [2009/09/20 22:12:22 \| 00,000,831 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\DivX Converter.lnk [2009/09/20 22:10:51 \| 00,001,466 \| ---- \| M] () -- C:\Documents and Settings\Gaby\Desktop\DivX Movies.lnk ========== Files - No Company Name ========== [2009/10/14 13:57:52 \| 00,501,736 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Desktop\LopSD.exe [2009/10/13 18:08:41 \| 00,053,753 \| ---- \| C] () -- C:\Scanplumon.jpg [2009/10/13 17:57:16 \| 00,080,094 \| ---- \| C] () -- C:\ScanScan.jpg [2009/10/12 00:12:22 \| 01,474,832 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\sfi.dat [2009/10/12 00:11:22 \| 00,000,808 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk [2009/10/11 20:54:53 \| 00,000,696 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/10/11 15:58:31 \| 00,000,611 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Desktop\NTREGOPT.lnk [2009/10/11 15:58:31 \| 00,000,592 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Desktop\ERUNT.lnk [2009/10/11 12:34:20 \| 00,000,310 \| ---- \| C] () -- C:\Documents and Settings\Gaby\My Documents\My Documents.lnk [2009/10/09 12:07:42 \| 00,000,868 \| ---- \| C] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/10/08 18:59:24 \| 01,246,256 \| ---- \| C] () -- C:\Google Updater.exe [2009/10/08 16:07:15 \| 01,111,904 \| ---- \| C] () -- C:\Setup_Registry_Defender.exe [2009/10/06 00:00:42 \| 00,000,719 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk [2009/10/05 23:55:37 \| 18,527,244 \| ---- \| C] () -- C:\Documents and Settings\Gaby\My Documents\vlc-1.0.2-win32.exe [2009/09/20 22:12:53 \| 00,000,795 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\DivX Player.lnk [2009/09/20 22:12:22 \| 00,000,831 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\DivX Converter.lnk [2008/10/27 01:15:24 \| 00,000,123 \| ---- \| C] () -- C:\WINDOWS\rootkitno.ini [2008/10/19 15:02:42 \| 00,000,078 \| ---- \| C] () -- C:\WINDOWS\lsoon.ini [2008/10/19 14:26:42 \| 00,075,264 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\ShLog.txt [2008/04/12 23:04:06 \| 00,000,653 \| ---- \| C] () -- C:\WINDOWS\entpack.ini [2008/03/12 02:04:57 \| 00,000,118 \| ---- \| C] () -- C:\WINDOWS\System32\MRT.INI [2006/08/01 18:32:48 \| 00,000,022 \| ---- \| C] () -- C:\WINDOWS\System32\PICSDK.ini [2006/08/01 18:31:23 \| 00,096,768 \| ---- \| C] () -- C:\WINDOWS\SlantAdj.dll [2006/08/01 18:31:23 \| 00,000,072 \| ---- \| C] () -- C:\WINDOWS\System32\epDPE.ini [2006/08/01 18:29:02 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\EPSON RX620 Installer.ini [2006/07/25 21:05:49 \| 00,001,362 \| ---- \| C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache [2006/05/03 20:15:27 \| 00,039,736 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Application Data\GDIPFONTCACHEV1.DAT [2006/01/02 18:18:17 \| 00,039,736 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2005/12/31 19:41:56 \| 00,000,029 \| ---- \| C] () -- C:\WINDOWS\atid.ini [2005/12/15 23:59:48 \| 00,000,093 \| ---- \| C] () -- C:\WINDOWS\R300.ini [2005/12/12 00:36:18 \| 00,044,544 \| ---- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/12/12 00:29:39 \| 00,000,376 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2005/11/28 13:35:10 \| 04,829,526 \| -H-- \| C] () -- C:\Documents and Settings\Gaby\Local Settings\Application Data\IconCache.db [2005/11/28 13:32:11 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\Gaby\Application Data\desktop.ini [2005/09/21 16:00:04 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini [2005/09/16 15:14:36 \| 00,157,184 \| ---- \| C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2004/08/04 05:00:00 \| 00,000,559 \| ---- \| C] () -- C:\WINDOWS\win.ini [2004/08/04 05:00:00 \| 00,000,231 \| ---- \| C] () -- C:\WINDOWS\system.ini [2002/10/07 19:15:36 \| 00,016,384 \| ---- \| C] () -- C:\WINDOWS\System32\e100bmsg.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 < End of report > --- Computer seems a bit faster now but when it goes to screen saver mode it takes awhile to get out of it, also Google still keeps redirecting me.

heir View Member Profile	Oct 15 2009, 10:51 PM Post #6
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	OK let's use another tool then. Step 1. ComboFix: Download ComboFix from one of these locations: Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Step 2. Things I would like to see in your reply: The content of C:\ComboFix.txt** from step 1. Information on how your computer is running now.

Panchan View Member Profile	Oct 17 2009, 12:35 AM Post #7
New Member Posts: 6 OS: Windows XP	Well I am encountering a little problem now, everytime I want to open Combofix.exe it gives me multiple error messages that say "32788R22FWJFW/iexplorer.exe" or "32788R22FWJFW/hidec.exe" in the header and the message say's "Windows cannot access the specific device, path, or file. You may not have the appropriate permission to access the item." Then it says "Windows cannot open this file: nircmd.cfxxe" I try renaming it Combo-Fix.exe but it gives me the same result. Anyway, I really appreciate your help thanks This post has been edited by Panchan: Oct 17 2009, 12:37 AM

heir View Member Profile	Oct 18 2009, 01:59 AM Post #8
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	Make sure that you've disabled the antivirus program. And try again

Panchan View Member Profile	Oct 19 2009, 01:44 PM Post #9
New Member Posts: 6 OS: Windows XP	Ok there we go, Apparently Avira and COMODO were still running but they were disabled. I tried to shut them down from task manager but the computer wouldn't let me with a "Access denied" message. Here's the Combofix log ComboFix 09-10-18.06 - Gaby 10/19/2009 12:11.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.300 [GMT -7:00] Running from: c:\documents and settings\Gaby\Desktop\ComboFix.exe AV: AntiVir Desktop On-access scanning disabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: COMODO Antivirus On-access scanning disabled (Outdated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B} FW: COMODO Firewall disabled {043803A3-4F86-4ef6-AFC5-F6E02A79969B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Gaby\Start Menu\Programs\Security Tool.lnk c:\windows\system32\dujosiye.exe c:\windows\system32\farewoka.exe c:\windows\system32\huvehibi.exe c:\windows\system32\lilofati.exe c:\windows\system32\logs c:\windows\system32\logs\Events.dat c:\windows\wiaserviv.log Infected copy of c:\windows\system32\drivers\IdeChnDr.sys was found and disinfected Restored copy from - Kitty ate it :^) c:\windows\system32\proquota.exe was missing Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe . ((((((((((((((((((((((((( Files Created from 2009-09-19 to 2009-10-19 ))))))))))))))))))))))))))))))) . 2009-10-19 19:22 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe 2009-10-19 19:22 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe 2009-10-19 18:36 . 2009-10-19 18:36 -------- d-----w- C:\32788R22FWJFW.16.tmp 2009-10-19 18:17 . 2009-10-19 18:19 -------- d-----w- C:\32788R22FWJFW.15.tmp 2009-10-17 06:33 . 2009-10-19 18:16 -------- d-----w- C:\32788R22FWJFW.14.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.13.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.12.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.11.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.10.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.9.tmp 2009-10-17 06:33 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.8.tmp 2009-10-17 06:32 . 2009-10-17 06:33 -------- d-----w- C:\32788R22FWJFW.7.tmp 2009-10-17 06:32 . 2009-10-17 06:32 -------- d-----w- C:\32788R22FWJFW.6.tmp 2009-10-17 06:32 . 2009-10-17 06:32 -------- d-----w- C:\32788R22FWJFW.5.tmp 2009-10-17 06:31 . 2009-10-17 06:32 -------- d-----w- C:\32788R22FWJFW.4.tmp 2009-10-17 06:25 . 2009-10-17 06:31 -------- d-----w- C:\32788R22FWJFW.3.tmp 2009-10-17 06:25 . 2009-10-17 06:25 3348750 ----a-w- C:\ComboFix.exe 2009-10-17 06:23 . 2009-10-17 06:25 -------- d-----w- C:\32788R22FWJFW.2.tmp 2009-10-17 06:22 . 2009-10-17 06:23 -------- d-----w- C:\32788R22FWJFW.1.tmp 2009-10-14 20:58 . 2009-10-14 21:23 -------- d-----w- C:\Lop SD 2009-10-12 21:06 . 2008-04-14 00:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll 2009-10-12 21:06 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll 2009-10-12 07:30 . 2009-10-12 07:30 -------- d-----w- C:\VundoFix Backups 2009-10-12 07:12 . 2009-10-19 18:40 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat 2009-10-12 07:10 . 2009-10-12 07:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo 2009-10-12 07:09 . 2009-10-12 07:09 87104 ----a-w- c:\windows\system32\drivers\inspect.sys 2009-10-12 07:09 . 2009-10-12 07:09 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2009-10-12 07:09 . 2009-10-12 07:09 179792 ----a-w- c:\windows\system32\guard32.dll 2009-10-12 07:09 . 2009-10-12 07:09 132296 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2009-10-12 07:09 . 2009-10-12 07:09 -------- d-----w- c:\program files\COMODO 2009-10-12 05:40 . 2009-10-12 05:41 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-10-12 03:54 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-12 03:54 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-12 03:54 . 2009-10-12 05:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-11 22:58 . 2009-10-12 05:38 -------- d-----w- c:\program files\ERUNT 2009-10-11 22:23 . 2009-10-11 22:23 -------- d-----w- C:\_OTL 2009-10-09 02:25 . 2009-10-12 05:40 -------- d-----w- C:\backups 2009-10-09 02:02 . 2009-10-09 02:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-10-09 02:02 . 2009-10-09 02:02 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-10-09 01:59 . 2009-10-12 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-10-09 01:59 . 2009-10-09 01:59 1246256 ----a-w- C:\Google Updater.exe 2009-10-09 01:36 . 2009-10-09 01:36 401720 ----a-w- C:\HiJackThis.exe 2009-10-08 23:24 . 2009-10-12 05:41 -------- d-----w- C:\ProgramData 2009-10-08 23:24 . 2009-10-12 05:41 -------- d-----w- c:\program files\Angle Interactive 2009-10-08 23:23 . 2009-10-12 05:40 -------- d-----w- c:\program files\XoftSpySE6 2009-10-08 23:07 . 2009-10-08 23:07 1111904 ----a-w- C:\Setup_Registry_Defender.exe 2009-10-08 23:03 . 2009-10-08 23:03 4276208 ----a-w- C:\XoftSpySE_Setup_RW.exe 2009-10-08 23:02 . 2009-10-08 23:02 26733144 ----a-w- C:\sdsetup.exe 2009-10-06 07:58 . 2009-10-09 06:12 -------- d-----w- c:\documents and settings\Gaby\Application Data\vlc . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-19 19:24 . 2008-01-02 06:57 -------- d-----w- c:\documents and settings\Gaby\Application Data\WTablet 2009-10-17 03:29 . 2008-01-03 19:27 -------- d-----w- c:\documents and settings\LocalService\Application Data\WTablet 2009-10-12 21:05 . 2007-09-27 17:29 -------- d-----w- c:\documents and settings\Gaby\Application Data\U3 2009-10-12 07:12 . 2007-07-15 22:35 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-10-12 05:41 . 2009-06-06 07:22 -------- d-----w- c:\program files\MediaRing 2009-10-12 05:37 . 2006-08-05 22:29 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-10-11 23:31 . 2008-12-16 09:58 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-10-09 01:59 . 2006-01-05 07:53 -------- d-----w- c:\program files\Google 2009-10-08 23:34 . 2007-04-25 19:52 39736 ----a-w- c:\documents and settings\Alma Rosa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-21 22:32 . 2009-03-18 06:21 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-09-21 05:13 . 2008-10-23 06:30 -------- d-----w- c:\program files\DivX 2009-09-15 07:29 . 2009-09-15 07:29 -------- d-----w- c:\documents and settings\Gaby\Application Data\Globe7 2009-09-15 06:52 . 2009-09-15 06:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2009-09-15 06:52 . 2009-09-15 06:52 -------- d-----w- c:\program files\Avira 2009-09-14 10:27 . 2009-09-14 10:27 -------- d-----w- c:\program files\Microsoft .NET Micro Framework 2009-09-14 07:25 . 2006-01-03 01:18 39736 ----a-w- c:\documents and settings\Gaby\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-09-06 14:56 . 2008-01-08 00:26 -------- d-----w- c:\documents and settings\Alma Rosa\Application Data\WTablet 2009-08-24 21:31 . 2008-04-26 22:19 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-08-07 02:24 . 2005-09-22 06:21 327896 ----a-w- c:\windows\system32\wucltui.dll 2009-08-07 02:24 . 2005-09-22 06:21 209632 ----a-w- c:\windows\system32\wuweb.dll 2009-08-07 02:24 . 2005-09-22 06:21 35552 ----a-w- c:\windows\system32\wups.dll 2009-08-07 02:24 . 2005-05-26 12:16 44768 ----a-w- c:\windows\system32\wups2.dll 2009-08-07 02:24 . 2005-09-22 06:21 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-08-07 02:24 . 2004-08-04 12:00 96480 ----a-w- c:\windows\system32\cdm.dll 2009-08-07 02:23 . 2005-09-22 06:21 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-08-07 02:23 . 2007-02-03 19:10 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-08-07 02:23 . 2007-02-03 19:10 215920 ----a-w- c:\windows\system32\muweb.dll 2009-08-07 02:23 . 2005-09-22 06:21 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-07-28 23:33 . 2009-09-15 06:52 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2006-07-24 02:23 . 2006-07-24 02:18 37518744 ----a-w- c:\program files\iTunesSetup.exe 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 1999-07-07 00:00 . 1999-07-07 00:00 6 --sh--r- c:\windows\@@desktop.dat 2008-10-19 21:29 . 2008-10-19 21:29 2 --shatr- c:\windows\winstart.bat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2005-08-18 18:49 . 2005-08-18 18:49 307200 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe 2006-05-10 00:24 . 2006-05-10 00:24 50760 c:\program files\Common Files\AOL\1136158983\ee\bak\AOLSoftware.exe 2002-10-23 18:15 . 2002-10-23 18:15 86016 c:\program files\Intel\NCS\PROSet\bak\PRONoMgr.exe 2006-06-14 23:24 . 2006-06-14 23:24 278528 c:\program files\iTunes\bak\iTunesHelper.exe 2007-07-15 22:39 . 2007-03-14 10:43 83608 c:\program files\Java\jre1.6.0_01\bin\bak\jusched.exe 2006-06-27 20:43 . 2006-06-27 20:43 282624 c:\program files\QuickTime\bak\qttask.exe 2006-10-31 22:34 . 2006-10-31 22:34 20752 c:\program files\Zune\bak\ZuneLauncher.exe 2008-09-13 01:46 . 2008-09-13 01:46 160160 c:\program files\Zune\ZuneLauncher.exe 2004-08-04 12:00 . 2004-08-04 12:00 15360 c:\windows\system32\bak\ctfmon.exe 2004-08-04 12:00 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe 2005-11-26 03:56 . 2004-02-10 18:51 118784 c:\windows\system32\bak\hkcmd.exe 2005-11-26 03:56 . 2004-02-10 18:55 155648 c:\windows\system32\bak\igfxtray.exe 2006-08-02 01:30 . 2004-05-19 20:00 98304 c:\windows\system32\spool\drivers\w32x86\3\bak\E_FATI9HA.EXE 2005-12-16 18:35 . 2003-06-04 10:00 99840 c:\windows\system32\spool\drivers\w32x86\3\bak\E_S4I2F1.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-04 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\QuickTime\bak\qttask.exe" [2006-06-27 282624] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-13 160160] "mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-10-12 1799952] "jiziselib"="c:\windows\system32\loyuvejo.dll" [N/A] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-09-23 90112] "sovarunizu"="dibididu.dll" [N/A] c:\documents and settings\Gaby\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-15 113664] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-12-15 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\guard32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1136158983\\ee\\aim6.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\StubInstaller.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Avira\\AntiVir Desktop\\avgnt.exe"= "c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"= "c:\\Documents and Settings\\Gaby\\Desktop\\OTL.exe"= R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [10/12/2009 12:09 AM 132296] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [10/12/2009 12:09 AM 25160] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9/14/2009 11:52 PM 108289] S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?] S2 0068391255330716mcinstcleanup;McAfee Application Installer Cleanup (0068391255330716);c:\docume~1\Gaby\LOCALS~1\Temp\006839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Gaby\LOCALS~1\Temp\006839~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?] . Contents of the 'Scheduled Tasks' folder 2009-10-19 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-03 01:59] . . ------- Supplementary Scan ------- . uDefault_Search_URL = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com uSearchURL,(Default) = hxxp://www.google.com/search?q=%s FF - ProfilePath - FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - SharedTaskScheduler-{eb5095e7-0289-4358-9aa0-093e3e174a90} - c:\windows\system32\loyuvejo.dll SSODL-vutenejol-{eb5095e7-0289-4358-9aa0-093e3e174a90} - c:\windows\system32\loyuvejo.dll AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\UninstFl.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-19 12:24 Windows 5.1.2600 Service Pack 3 NTFS detected NTDLL code modification: ZwClose, ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2904) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\ArcSoft\Software Suite\PhotoImpression 5\share\pihook.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\COMODO\COMODO Internet Security\cmdagent.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Maxtor\Sync\SyncServices.exe c:\windows\system32\Tablet.exe c:\windows\system32\ZuneBusEnum.exe c:\program files\Zune\ZuneNss.exe c:\windows\system32\WTablet\TabUserW.exe c:\windows\system32\Tablet.exe c:\combofix\CF722.exe . ************************************************************************ . Completion time: 2009-10-19 12:37 - machine was rebooted ComboFix-quarantined-files.txt 2009-10-19 19:37 Pre-Run: 57,214,926,848 bytes free Post-Run: 57,030,672,384 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 5BD033D18405EF5EC11D853CC2D58C36 -- Computer Status: it's running slow

heir View Member Profile	Oct 21 2009, 05:55 AM Post #10
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	Step 0. Antivirus software: QUOTE AV: AntiVir Desktop On-access scanning disabled (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: COMODO Antivirus On-access scanning disabled (Outdated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B} You only need ONE antivirus program. If you have more then one the will interfere with each other and slow down your system. Uninstall one of them. Step 1. Filescan: Using Internet Explorer please go to VirSCAN.org FREE on-line scan service Copy and paste the following file path into the "Suspicious files to scan"box on the top of the page: c:\windows\winstart.bat Click on the Upload button Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard. Paste the contents of the Clipboard in your next reply. Do the same with this: c:\windows\@@desktop.dat Step 2. CFScript: 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the codebox below into it: CODE File:: C:\32788R22FWJFW.16.tmp C:\32788R22FWJFW.15.tmp C:\32788R22FWJFW.14.tmp C:\32788R22FWJFW.13.tmp C:\32788R22FWJFW.12.tmp C:\32788R22FWJFW.11.tmp C:\32788R22FWJFW.10.tmp C:\32788R22FWJFW.9.tmp C:\32788R22FWJFW.8.tmp C:\32788R22FWJFW.7.tmp C:\32788R22FWJFW.6.tmp C:\32788R22FWJFW.5.tmp C:\32788R22FWJFW.4.tmp C:\32788R22FWJFW.3.tmp C:\32788R22FWJFW.2.tmp C:\32788R22FWJFW.1.tmp c:\windows\system32\loyuvejo.dll c:\windows\system32\dibididu.dll Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "jiziselib"=- "sovarunizu"=- Filelook:: c:\windows\winstart.bat c:\windows\@@desktop.dat Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Step 3. Systemlook: Please download SystemLook from one of the links below and save it to your Desktop. Download Mirror #1 Download Mirror #2 Double-click SystemLook.exe to run it. Copy the content of the following codebox into the main textfield: CODE :contents c:\windows\winstart.bat c:\windows\@@desktop.dat Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt Step 4. Things I would like to see in your reply: The results from the filescan from step 1. The content of C:\ComboFix.txt from step 2. The content of Systemlook.txt from step 3. Information on how your computer is running after those steps.

heir View Member Profile	Oct 24 2009, 11:48 PM Post #11
Trusted Helper Posts: 3,488 From: Sweden OS: Windows XP SP3	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Help With Google Redirect Problem [Closed] [Solved] 12	16 / 512	7th October 2009 - 06:57 AM PA Jeeper started - last by handhfan
Virus, Spyware and Trojan Removal Google Redirect problem. [Closed]	3 / 132	27th August 2009 - 10:56 AM leebohanson started - last by Transience
Virus, Spyware and Trojan Removal Total Security 2009 and Google redirect [Closed]	3 / 148	5th September 2009 - 11:35 AM jcar1 started - last by Essexboy
Virus, Spyware and Trojan Removal Google Redirect problem [Closed]	2 / 69	22nd October 2009 - 05:24 AM Melizalde started - last by Rorschach112