Okay, I spent hour on the net last night trying to fix this. I have no clue what to do now.

I looked at other people who had similar problems.

Okay here is what happened. My friend, who must have been infected sent me an image that he made, all of the sudden I am getting popups which never happened before. I load up PeerGuardian and I see that this Cyber Technology BA BV/SPRL is being blocked, while its being blocked, no popups. I did some research and finally found somthing called Vundo may be the cause.

The IP to this is: Edit to remove URL - Doug

*****Edit*****

Found another symptom, when i go to google, I search, then i click on one of the search findings it redirects me to an ad site, but if i right click open in new tab it doesnt.

So i download Malwarebytes, I get three infections, one including something called muluniba (which was removed)

I then downloaded VundoFix, it found four files, I clicked "Fix" and it said they could not be delete, reboot computer, I did, I clicked on Vundo Fix and it had the files there still, so I did the same, it said reboot again...so It was like 6 am so i went to bed... i wake up and i look and the files were not listed on Vundo fix after i loged opend vundoFix.

So i am running a VundoFix again as we speak, Also instead of a "Quick Scan" with Malwayrebytes, i am running a full scan.

I also wanted to mention, i ran Stinger, found nothing...

Here is a HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:06 AM, on 10/4/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\UDisk utility 1.00.14\UDisk.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Users\James\Desktop\VundoFix.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\qsacc\x1exec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\something.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.flashget.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.44.66;64.136.52.66;64.136.52.70;searchap.untd.com;127.0.0.1;localhost;*mi
crosoft.com;*windowsupdate.com;*wustat.windows.com;*.yimg.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkass
ociates.com;*.mail.yahoo.com;cf.netzero.net;qs.netzero.net;*.aolcdn.com;*.quicke
n
.com;*.pogo.com;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NetZero\SearchEnh1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Pop-up Blocker - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\Program Files\Juno\Toolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\Something.exe" /runcleanupscript
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [SpywareStop] C:\Program Files\SpywareStop\SpywareStop.exe -boot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [risky] C:\Users\James\AppData\Roaming\84372872az.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [jefiwejed] Rundll32.exe "c:\progra~2\ribegaja\ribegaja.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: UDisk Assistant.lnk = ?
O4 - Global Startup: Ultra Hal Text-to-Speech Reader Startup.lnk = ?
O8 - Extra context menu item: Display All Images with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/228"
O8 - Extra context menu item: Display Image with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/227"
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download with Rapget - C:\Users\James\Desktop\Rapget.v.1.41\Rapget.v.1.41\rapget.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O13 - Gopher Prefix:
O15 - Trusted Zone: *.juno.com
O15 - Trusted Zone: *.netzero.com
O15 - Trusted Zone: *.netzero.net
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{49DC8021-0889-493C-AD11-3A861E6E0EAB}: NameServer = 64.136.52.75 64.136.44.75
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 13710 bytes


Please help before i pull my hair out... This infection is a nasty beast.

--------------------------------------------------------------------------------------------------------

Here is what VundoFix found
C:\Windows\System32\EXPAudioCDGrabber2.dll
C:\Windows\System32\EXPAudioFile2.dll
C:\Windows\System32\EXPAudioPlayer2.dll
C:\Windows\System32\EXPAudioRecord2.dll
C:\Windows\System32\EXPWMAFile2.dll
----------------------------------------------------------------------------------------------------------

Okay I just ran Sytamantic's Vundo removal tool, here is the message I recived:

Cannot Scan Winlogon plugins!
Trojan.Vundo has not been found on your computer.
----------------------------------------------------------------------------------------------------------

I am hoping i do not have that nasty virus Vundo.

This post has been edited by Elegance: Oct 10 2009, 10:19 AM

Can you post the results from the scan?

Sure can:

First quick scan
--------------------------------------------------------------------------------------------
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 6.0.6000

10/3/2009 7:55:01 PM
mbam-log-2009-10-03 (19-55-01).txt

Scan type: Quick Scan
Objects scanned: 96413
Time elapsed: 8 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\MSx (Rogue.MSAntiVirus) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sohaniluzo (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\ProgramData\muluniba\muluniba.dll (Trojan.Agent) -> Delete on reboot.

---------------------------------------------------------------------------------------------------------
Full Scan

Malwarebytes' Anti-Malware 1.41
Database version: 2922
Windows 6.0.6000 (Safe Mode)

10/5/2009 2:19:04 PM
mbam-log-2009-10-05 (14-19-04).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 414396
Time elapsed: 1 hour(s), 16 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
----------------------------------------------------------------------------------------------------
SpyBot Search and Destroy Scan


Search result list ---
AdwareAlert: [SBI $4B7BCDE7] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledRun

AdwareAlert: [SBI $714BCC83] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DisabledUninstall

AdwareAlert: [SBI $5BD92570] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DisabledBHO

Fake.MSAntivirus: [SBI $E6F4FFDD] Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\Software\MSx

SpywareBOT.SpywareStop: [SBI $144C1726] Program directory (Directory, nothing done)
C:\Users\James \AppData\Roaming\SpywareStop\

SpywareBOT.SpywareStop: [SBI $BA471462] Data (File, nothing done)
C:\Users\James \AppData\Roaming\SpywareStop\rs.dat
Properties.size=537
Properties.md5=EE7DCB3319C75F0AEF7ACD7F8A5BAFF2
Properties.filedate=1210273188
Properties.filedatetext=2008-05-08 14:59:48

SpywareBOT.SpywareStop: [SBI $BCDE3B78] Log file (File, nothing done)
C:\Users\James \AppData\Roaming\SpywareStop\Log\2008 May 08 - 01_54_13 PM_326.log
Properties.size=11323
Properties.md5=1C72586747C8E98D1D4CA62BE213B3C7
Properties.filedate=1210273379
Properties.filedatetext=2008-05-08 15:02:58

SpywareBOT.SpywareStop: [SBI $9B7172F3] Data (File, nothing done)
C:\Users\James \AppData\Roaming\SpywareStop\Settings\ScanResults.pie
Properties.size=915898
Properties.md5=3791CDFFC786FD148A2935C941B73A2E
Properties.filedate=1210273214
Properties.filedatetext=2008-05-08 15:00:14

SpywareBOT.SpywareStop: [SBI $1AEC05D6] Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-343026371-123314989-4225207537-1000\Software\SpywareStop

DoubleClick: Tracking cookie (Internet Explorer: James ) (Cookie, nothing done)


MediaPlex: Tracking cookie (Internet Explorer: James ) (Cookie, nothing done)


MediaPlex: Tracking cookie (Internet Explorer: James ) (Cookie, nothing done)


AdRevolver: Tracking cookie (Internet Explorer: James ) (Cookie, nothing done)


Right Media: Tracking cookie (Internet Explorer: James ) (Cookie, nothing done)


DoubleClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


BurstMedia: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


AdRevolver: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


AdRevolver: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


AdRevolver: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


AdRevolver: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


BurstMedia: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


TargetNet: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


WebTrends live: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


SexList: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


DoubleClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Clickbank: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


BurstMedia: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


BurstMedia: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


FastClick: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Statcounter: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: James (default)) (Cookie, nothing done)

I clicked fix all on these, and they no longer show up.

I would like to add, I used GooRedFix, and I think it might have fixed my Google Redirect. I do not know, because yesterday after about 30 times, It did try to redirect me to a Home Owners site, so I do not know.


Thanks for the help, I didnt post the full log of Spybot because it was too long, but i posted the results. Thank you for taking the time to view my message

This post has been edited by Elegance: Oct 11 2009, 11:41 AM

1. These tools MUST be run from the executable. (.exe)
2. With Admin Rights (Right click, choose "Run as Administrator") every time you run them

Download ComboFix from one of these locations:

Link 1
Link 2


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.


---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

• Drag the setup package onto ComboFix.exe and drop it.
  
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  
  
  
  
  
• At the next prompt, click 'Yes' to run the full ComboFix scan.
  
  
• When the tool is finished, it will produce a report for you.

Please post the C:\ComboFix.txt in your next reply using Copy/Paste.


Notes:

Give it atleast 20-30 minutes to finish if needed.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Also please describe how your computer behaves in your next reply.

Okay, I hate to ruin the flow, I got to the part where i was to go to http://support.microsoft.com/kb/310994 , Howeverm I am running Windows Vista. Should i use one of these anyway?

I'd skip that part and move on to running Combofix.

Well i double clicked it, ran as administrator and after i turned off my anti-spyware and anti-virus it brought up what looked like a blue box, then came up with this error:

"Data Error 2009-10-06

Check your settings"

Also please note my Computer is set to that date.

This post has been edited by Elegance: Oct 12 2009, 07:53 AM

Delete the combofix you have now and try this:

Download Combofix from any of the links below but rename it to ABCD.exe before saving it to your desktop.

Link 1
Link 2


Double click on the ABCD.exe ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

I recived the same error, I downloaded the file as ABCD.exe as instructed. Please note my PC is set to the same date the error says (because my computer loses track of time for some reason. Here is the error:

"Date Error: 2009-10-07

Please Check your Settings"

I shut down my virus protection while doing it, and just now, while typing this message, after i turned my anti vrius back on. Windows Defender for the first time came up with:

"Category:
Trojan

Description:
This program displays advertisements and may be difficult to remove.

Advice:
Remove this software immediately.

Resources:
file:
c:\ProgramData\ribegaja\ribegaja.dll

Summary:
Application Execution change occurred.

This agent scans software just before it runs. You are alerted if the software has a high potential for harming your computer.

Checkpoint:
Running Processes

View more information about this item online"


It is calling it Vundo.

I am going to click remove.

I'll let you know what happens.
----------------------------------------------------------------------------------------------------
RunDLL:

Error loading c:\progra~2\ribegaja\ribegaja.dll

The specified module could not be found

SpyBot Search & Destroy:



SpyBot Search & Destroy has detected an important

registry that has been changed

Catagory: Disable Command
Change: Value added
Entry: DisableCMD
Old data: (Ghosted)
New Data: 0

I denied this change

It asked again

Denied again

Asked again

This time I will click "Rember this decision" and deny

Nothing poped afterward.

Now i go into Program Data folder, see folders :

ribegaja, wiwirira, zomibole. All folders empty, and

right clicked 0 files 0 mb. All hidden files shown.

Nothing in folders.

I do not know what wiwirira, zomibole were but they

were suspicous in my thoughts.

Now to test and see if Peer Guardian still detects

Cyber Technology BV BA/SPRL.

So far, loaded my post on whatthetech.com, and peer guardian did not block Cyber Technology BV BA/SPRL. Will try other sites now.

Loading a Hockey fight website to test out... Nothing yet, so far so good. (quick note, FireFox blocked a popup)

So no Cyber Technology BV BA/SPRL being found, no pop ups. I'll let you know if anything happens soon.
-------------------------------------------------------------------------------------------------------------

After about 1 and so odd hours on the net, no popups, no Cyber Technology BV BA/SPRL trying connect. Symptoms seem to have disappeared.

I am sure the process is not over, So I ask you, is there a clean up process we must do?

This post has been edited by Elegance: Oct 12 2009, 09:34 PM

I'm checking into why CF won't run.
I let you know what I find out.

Did you check your date and time from the taskbar before running CF?

Ya, well it has been common for my Date and time to be off, it was before I was infected with that Vundo.

It may have bene caused by another virus, it started after i connected to the internet a few months back. There were not signs of infection though, so it was just an annoyance, i thought mabe it was trying to sinc with the nets time or something. It may be fixed, I have been to lazy to change it back

Did you try running combofix after making sure the time and date were correct?

No, I can try, My computer seems to be behaving and I have no signs of infections. ALthough i do get the .dll error on starter from

"RunDLL:

Error loading c:\progra~2\ribegaja\ribegaja.dll

The specified module could not be found"

You think i should try since my computer seems to be Vundo free?

Yes. Run Combofix.
It's still trying to load ribegaja.dll which I believe is bad.

ALright, it has been run, I set my clock to the right time, now... I ran it, Got its log posted bellow, However there are a few thigs I want to note.

After I ran this, I seem to have 30 days of Nortan Anti-Virus, Which I shouldnt... Hell I'll take it gladyly. I will not update it until you say it is alright, I do not think it is a virus, but I will make sure i consulted you first.

Okay, another thing, I've got a ton of notices from Spybot about Registry changes, wheater to allow or disallow, I allowed some, I disallowed some. It is difficult for me to decide. I think i made educated duductions on which to allow and which to disallow.

Anyway, here is my Log

----------------------------------------------------------------------------------------------------------------------

ComboFix 09-10-12.02 - James 10/13/2009 20:15.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.1022.490 [GMT -4:00]
Running from: c:\users\James \Desktop\ABCD.exe
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *disabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SpywareStop *disabled* (Updated) {F87186A9-6E53-4764-A1D3-16D92A3D0FB2}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1738422755-998661840-641317060-500
c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\$recycle.bin\S-1-5-21-343026371-123314989-4225207537-500
c:\program files\FlashGet Network
c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\James \AppData\Roaming\BITS
c:\users\James \AppData\Roaming\BITS\BITS.ini
c:\users\James \AppData\Roaming\BITS\DHTTable.dat
c:\users\James \AppData\Roaming\BITS\pl.dat
c:\users\James \AppData\Roaming\BITS\ProxyList.ini
c:\users\James \AppData\Roaming\FlashGetBHO
c:\users\James \AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
c:\users\James \AppData\Roaming\FlashGetBHO\GetAllUrl.htm
c:\users\James \AppData\Roaming\FlashGetBHO\GetUrl.htm
c:\windows\system32\secustat.dat

----- BITS: Possible infected sites -----

hxxp://download.aim.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OREANS32
-------\Service_oreans32


((((((((((((((((((((((((( Files Created from 2009-09-14 to 2009-10-14 )))))))))))))))))))))))))))))))
.

2009-12-16 04:53 . 2009-09-29 04:16 -------- d-----w- C:\Downloads
2009-12-16 04:53 . 2009-12-16 04:53 -------- d-----w- c:\users\James \AppData\Roaming\FlashGet
2009-10-14 00:28 . 2009-10-14 00:28 -------- d-----w- c:\users\Sharon \AppData\Local\temp
2009-10-14 00:28 . 2009-10-14 00:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-08 00:45 . 2009-10-08 00:45 -------- d-----w- c:\users\James \AppData\Local\AIM
2009-10-07 18:08 . 2009-10-08 12:10 -------- d-----w- c:\users\James \AppData\Local\Adobe
2009-10-07 12:12 . 2009-10-07 12:12 -------- d-----w- C:\ABCD
2009-10-07 01:14 . 2009-10-07 12:12 -------- d-----w- C:\ComboFix
2009-10-06 07:14 . 2009-10-06 07:14 -------- d-----w- c:\programdata\Office Genuine Advantage
2009-10-06 03:22 . 2009-10-06 03:22 -------- d-----w- c:\users\James \AppData\Local\AOL OCP
2009-10-06 03:21 . 2009-10-06 03:21 -------- d-----w- c:\users\James \AppData\Local\AOL
2009-10-05 02:48 . 2009-10-05 02:51 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-05 02:48 . 2009-10-05 02:48 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-04 18:14 . 2009-10-04 18:14 262144 ----a-w- C:\ntuser.dat
2009-10-04 15:40 . 2009-10-04 15:40 24576 ----a-w- c:\windows\system32\VundoFixSVC.exe
2009-10-04 11:14 . 2009-10-04 11:14 -------- d-----w- c:\program files\Trend Micro
2009-10-04 01:20 . 2009-10-04 15:53 -------- d-----w- C:\VundoFix Backups
2009-10-03 23:31 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-03 23:31 . 2009-10-04 00:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-03 23:31 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-03 23:11 . 2009-10-03 23:11 -------- d-----w- c:\users\James \AppData\Roaming\Malwarebytes
2009-10-03 23:10 . 2009-10-03 23:10 -------- d-----w- c:\programdata\Malwarebytes
2009-10-03 21:04 . 2009-10-03 21:04 -------- d-----w- c:\programdata\natowoso
2009-10-03 20:51 . 2009-10-07 12:37 -------- d-----w- c:\programdata\ribegaja
2009-10-03 20:51 . 2009-10-04 14:01 -------- d-----w- c:\programdata\lokowere
2009-10-03 20:51 . 2009-10-03 20:51 -------- d-----w- c:\programdata\wiwirira
2009-10-03 20:51 . 2009-10-03 20:51 -------- d-----w- c:\programdata\zomibole
2009-10-03 20:45 . 2009-10-03 23:56 -------- d-----w- c:\programdata\muluniba
2009-10-03 20:45 . 2009-10-03 20:45 -------- d-----w- c:\programdata\jelayube
2009-10-03 20:45 . 2009-10-03 20:45 -------- d-----w- c:\programdata\gekohani
2009-10-03 02:42 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-03 02:42 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-03 02:42 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-03 02:42 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-03 02:41 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-03 02:41 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-03 02:41 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-03 02:41 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-03 02:41 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-09-30 13:53 . 2009-10-01 14:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-09-27 03:18 . 2009-09-27 03:44 -------- d-----w- c:\users\James \AppData\Roaming\Mount&Blade Warband
2009-09-27 03:09 . 2009-09-27 03:19 -------- d-----w- c:\program files\Mount&Blade Warband
2009-09-14 15:38 . 2009-09-14 15:38 -------- d-----w- c:\program files\Convertor
2009-09-14 11:52 . 2009-09-14 11:52 552 ----a-w- c:\users\James \AppData\Local\d3d8caps.dat
2009-09-14 05:46 . 2009-09-14 05:54 -------- d-----w- c:\program files\GLIntercept0_5

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-08 15:39 . 2009-09-03 11:20 -------- d-----w- c:\program files\PeerGuardian2
2009-10-08 15:38 . 2008-04-20 18:56 -------- d-----w- c:\users\James \AppData\Roaming\Free Download Manager
2009-10-08 12:10 . 2009-09-13 11:04 4 ----a-w- c:\users\James \AppData\Local\C5811E01.DAT
2009-10-08 12:10 . 2009-09-13 11:04 4 ----a-w- c:\programdata\C5811E01.DAT
2009-10-08 09:37 . 2007-09-12 15:57 8268 ----a-w- c:\users\James \AppData\Local\d3d9caps.dat
2009-10-08 01:19 . 2009-09-13 11:03 -------- d-----w- c:\program files\MilkShape 3D 1.8.0
2009-10-05 12:27 . 2008-09-04 23:00 -------- d-----w- c:\users\James \AppData\Roaming\gtk-2.0
2009-10-03 21:13 . 2008-05-08 06:22 -------- d-----w- c:\users\James \AppData\Roaming\Spyware Terminator
2009-10-03 21:13 . 2008-05-08 06:22 -------- d-----w- c:\program files\Spyware Terminator
2009-10-03 15:49 . 2007-08-24 04:36 4444 ----a-w- c:\users\James \AppData\Roaming\wklnhst.dat
2009-09-30 23:04 . 2009-06-07 03:34 -------- d-----w- c:\program files\World of Warcraft
2009-09-15 11:27 . 2009-05-15 01:27 -------- d-----w- c:\program files\Chuzzle Deluxe
2009-09-13 11:04 . 2008-12-20 01:40 -------- d-----w- c:\users\James \AppData\Roaming\MilkShape 3D 1.x.x
2009-09-12 14:59 . 2009-09-12 14:59 -------- d-----w- c:\program files\tamasoftware
2009-09-12 09:57 . 2007-08-20 22:48 -------- d-----w- c:\programdata\Roxio
2009-09-12 09:31 . 2009-09-11 07:47 -------- d-----w- c:\program files\Pcsx2
2009-09-07 07:02 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-06 09:53 . 2009-04-29 23:02 -------- d-----w- c:\program files\NetZero
2009-09-04 21:44 . 2009-09-12 09:17 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:44 . 2009-09-12 09:17 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-09-04 21:44 . 2009-09-12 09:17 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-09-04 21:29 . 2009-09-12 09:17 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-09-04 21:29 . 2009-09-12 09:17 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-09-04 21:29 . 2009-09-12 09:17 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-09-04 21:29 . 2009-09-12 09:17 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-09-04 21:29 . 2009-09-12 09:17 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-09-04 15:20 . 2008-08-04 02:39 -------- d-----w- c:\programdata\eMule
2009-09-04 11:53 . 2008-09-04 22:55 -------- d-----w- c:\program files\GIMP-2.0
2009-09-03 21:42 . 2007-09-01 03:36 28 ----a-w- c:\windows\popcinfo.dat
2009-08-29 03:41 . 2009-09-03 07:38 1686528 ----a-w- c:\windows\system32\gameux.dll
2009-08-29 03:40 . 2009-09-03 07:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 23:31 . 2009-09-03 07:38 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-14 17:16 . 2009-09-07 14:42 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2009-08-14 16:42 . 2009-09-07 14:42 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2009-08-14 16:40 . 2009-09-07 14:42 103936 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:40 . 2009-09-07 14:42 15360 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:25 . 2009-09-07 14:42 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:25 . 2009-09-07 14:42 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:25 . 2009-09-07 14:42 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:25 . 2009-09-07 14:42 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:25 . 2009-09-07 14:42 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:25 . 2009-09-07 14:42 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:25 . 2009-09-07 14:42 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 14:24 . 2009-09-07 14:42 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 14:23 . 2009-09-07 14:42 22016 ----a-w- c:\windows\system32\netiougc.exe
2009-08-03 19:07 . 2009-08-03 19:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 19:07 . 2009-08-03 19:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 19:07 . 2009-08-03 19:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-19 18:27 . 2007-08-25 13:46 1666 ----a-w- c:\users\Sharon \AppData\Roaming\wklnhst.dat
2009-07-18 12:17 . 2009-09-03 00:18 827392 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 12:10 . 2009-09-03 00:18 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-07-18 12:10 . 2009-09-03 00:18 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 12:07 . 2009-09-03 00:18 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-18 10:00 . 2009-09-03 00:18 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 08:34 . 2009-09-03 00:18 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-07-17 14:52 . 2009-07-30 00:17 71680 ----a-w- c:\windows\system32\atl.dll
2008-08-07 15:12 . 2008-08-07 15:12 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-08-21 06:14 . 2007-08-21 06:14 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 101080]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2006-11-02 2159104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-08-21 1006264]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-12-03 107112]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-12-03 22696]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 17920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-07 29744]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2006-10-03 221184]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALuNotify.exe" [2007-09-13 492912]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-27 185896]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\something.exe" [2009-09-10 1312080]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-15 4390912]

c:\users\James \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1996-12-4 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1996-12-4 51984]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-8-20 50688]
Forget Me Not.lnk - c:\program files\Broderbund\AG CreataCard\AGRemind.exe [2008-5-21 323584]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
UDisk Assistant.lnk - c:\program files\UDisk utility 1.00.14\UDisk.exe [2008-12-25 532480]
Ultra Hal Text-to-Speech Reader Startup.lnk - c:\windows\Installer\{96EF451E-A402-44D8-BAEE-D70D558A4122}\New_Shortcut_S1449_0EB7CDB78E0C4A918D2CA535D5B8160C.exe [2009-7-29 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{60154427-9C70-4466-A745-3D04917BD5A4}c:\\program files\\yahoo!\\messenger\\ypager.exe"= UDP:c:\program files\yahoo!\messenger\ypager.exe:Yahoo! Messenger
"UDP Query User{E0738564-F31D-4154-B3F5-2FB4B004BBAA}c:\\program files\\yahoo!\\messenger\\ypager.exe"= TCP:c:\program files\yahoo!\messenger\ypager.exe:Yahoo! Messenger
"{7A3AB6C6-418B-4DEA-A14A-0CC47DFF82FD}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{97E505D5-0475-4D34-A452-264895690DB8}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{625F1FEC-397B-47CE-8E06-625E2708C473}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0ADB336D-6C37-40CE-8DAE-04BA13EBDF4B}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{B7034F7E-D4AA-48D3-BF28-B28A99C59A96}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{688BD372-26FD-477D-B05D-2386E8827463}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{2080D7BB-AF71-4CA5-8619-FC8011FDDDE9}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{605CF5C0-EA96-4A83-8DF8-FB8D6061145E}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{571310C2-39A2-4A2D-A755-449F19237BCE}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{0B34EE8C-99D0-4D72-91CB-1484EB1D1965}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{1D69947F-6930-422B-A20E-6114AA360ADF}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{54F5614B-6BCB-4EBC-B38D-E02A40B06FA4}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{D6EF8D1C-13CA-4658-9B78-686343B116D1}"= TCP:c:\program files\AIM6\aim6.exe:AIM

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"$INSTDIR\\FlvDetector.exe"= c:\program files\FlashGet Network\FlashGet 3\FlvDetector.exe:*:Enabled:FGFlvDetector
"c:\\Program Files\\FlashGet Network\\FlashGet 3\\FlashGet3.exe"= c:\program files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070828.001\IDSvix86.sys [9/6/2007 12:18 AM 212280]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [10/4/2009 10:48 PM 1153368]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/4/2008 12:05 AM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/6/2007 12:20 AM 112688]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [12/3/2006 7:26 PM 37008]
S3 FileObjInfo;STFileDriver;c:\programdata\Spyware Terminator\fileobjinfo.sys [5/8/2008 2:22 AM 5632]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/20/2007 7:02 PM 29744]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [11/16/2008 6:00 PM 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [11/16/2008 6:00 PM 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [11/16/2008 6:00 PM 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0016mgmt.sys [11/16/2008 6:00 PM 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\System32\drivers\s0016nd5.sys [11/16/2008 6:00 PM 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\System32\drivers\s0016obex.sys [11/16/2008 6:00 PM 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\System32\drivers\s0016unic.sys [11/16/2008 6:00 PM 115752]
S3 VundoFixSvc;VundoFix Service;VundoFixSVC.exe --> VundoFixSVC.exe [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {65E6362A-B878-4A7B-86DA-D16F8DBD75C7} /qb
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.flashget.com/
uInternet Settings,ProxyOverride = 64.136.44.66;64.136.52.66;64.136.52.70;searchap.untd.com;127.0.0.1;localhost;*mi
crosoft.com;*windowsupdate.com;*wustat.windows.com;*.yimg.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkass
ociates.com;*.mail.yahoo.com;cf.netzero.net;qs.netzero.net;*.aolcdn.com;*.quicken
.com;*.pogo.com;<local>
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: Display All Images with Full Quality - "c:\program files\NetZero\qsacc\appres.dll/228"
IE: Display Image with Full Quality - "c:\program files\NetZero\qsacc\appres.dll/227"
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Download with Rapget - c:\users\James \Desktop\Rapget.v.1.41\Rapget.v.1.41\rapget.htm
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\James \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: juno.com
Trusted Zone: netzero.com
Trusted Zone: netzero.net
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\users\James \AppData\Roaming\Mozilla\Firefox\Profiles\byd0m3x5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFFab&query=
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npWebLaunch.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\windows\system32\npmirage.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-SpywareStop - c:\program files\SpywareStop\SpywareStop.exe
HKCU-Run-risky - c:\users\James \AppData\Roaming\84372872az.exe
HKCU-Run-jefiwejed - c:\progra~2\ribegaja\ribegaja.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-13 20:35
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(936)
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
c:\program files\Common Files\microsoft shared\VS7Debug\mdm.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Zabaware\HalReader\HalReader.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2009-10-14 20:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-14 00:44

Pre-Run: 71,042,912,256 bytes free
Post-Run: 71,453,396,992 bytes free

343 --- E O F --- 2009-10-07 06:34
________________________________________________________________________________
__

That is the end of the log, Please let me know if it is safe to update my nortan, and if it is a common issue to have 30 days after the ComboFix.