What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] my log file...help!

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I seem to have malware and or spyware of some sort on my pc. I run windows vista. I cannot even download a new security program because the virus won't even allow it. My hijackthis log is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:54 PM, on 5/11/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM6\aim6.exe
C:\Users\Best Buy\AppData\Roaming\Smilebox\SmileboxTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Best Buy\AppData\Roaming\ptidle\ptidle.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch…TB&M=T-1628
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch…TB&M=T-1628
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…TB&M=T-1628
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch…TB&M=T-1628
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\Sidebar.exe" /autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SmileboxTray] "C:\Users\Best Buy\AppData\Roaming\Smilebox\SmileboxTray.exe"
O4 - HKCU\..\Run: [Antispyware] C:\Program Files\Antispyware\Antispyware.exe -boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ptidle] "C:\Users\Best Buy\AppData\Roaming\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [lewesazera] Rundll32.exe "C:\ProgramData\zebipubo\zebipubo.dll",s
O4 - HKCU\..\Run: [64e81f28] rundll32.exe "C:\ProgramData\dasejaru\dasejaru.dll",b
O4 - HKCU\..\Run: [CPM67db2cb4] Rundll32.exe "C:\ProgramData\roroboti\roroboti.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/OneClickFix/tgctlsr.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/…s/wlscctrl2.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0642DD7D-5C7B-43F3-AF78-622D89020FB5}: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{32D62CB6-4A6B-4863-9725-CA364B5E72E5}: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CS1\Services\Tcpip\..\{0642DD7D-5C7B-43F3-AF78-622D89020FB5}: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CS2\Services\Tcpip\..\{0642DD7D-5C7B-43F3-AF78-622D89020FB5}: NameServer = 85.255.112.155,85.255.112.153
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.155,85.255.112.153
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: DfLogon - LogonDll.dll (file missing)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: SupportSoft Repair Service (providercomcast) (tgsrvc_providercomcast) - SupportSoft, Inc. - C:\Program Files\providerComcast\bin\tgsrvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 9674 bytes




I really appreciate any help anyone can give me!
Post #2
Hello & Welcome to What the Tech

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Options, then click Track this topic. Make sure it is set to Immediate Email Notification, then click Proceed.

In the meantime please note the following:
  • Any recommendations made are for your computer problems only and should NOT be used on any other computer.
  • Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
    1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
    2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
  • If you get stuck or are unsure of something please ask for a further explanation, do not guess.
  • It will require more than one round to properly clean your system. Continue to respond to this thread until I give you the All Clean! even if symptoms seemingly abate.
Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.
If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave & if there is no contact for that amount of time I will have to assume you have abandoned your topic.

Thanks

No Anti-virus
Looking over your log, it seems you don't have any evidence of anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

Your computer must have only ONE anti-virus program installed at any time. Having more than one anti-virus program installed & active will cause program conflicts, false virus alerts, and system crashes.

ATF Cleaner
Download ATF Cleaner here by Atribune.
Right-click ATF-Cleaner.exe then choose Run as Administratorto run the program
Under Main choose: Select All
Click the Empty Selected button
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
Click Exit on the Main menu to close the program.

Combofix
Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

**IMPORTANT !!! Rename ComboFix.exe to Commy.exe BEFORE saving it to your Desktop**

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    A guide to do this can be found here
  • Right-click on ComboFix.exe then choose Run as Administrator to run the program & follow the prompts
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Gmer
Download gmer.zip from Gmer here & save it to your desktop.
  • Right click on gmer.zip, select Extract All… & extract the contents to your desktop
  • Right-click on Gmer.exe then choose Run as Administrator to run the program. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post
  • Save it where you can easily find it, such as your desktop, and post it in reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Note: Do not run any programs while Gmer is running.

I would also like to see a list of insalled programs, so please do this:
Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open. Post the contents of that file in your next reply.

To post in next reply:
Contents of Combofix log
Contents of Gmer log
Contents Add-Remove Programs.txt
Post #3
Wow. Not much luck. The combo fix downloaded and never even allowed me to change the name. Instead an error popped up and said i must choose an alphanumeric name but then nothing happened. So combo fix didn't work for me. I got the gmer to work though, and this is the log:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-12 21:38:29
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

SSDT AC1651CC ZwCreateThread
SSDT AC1651B8 ZwOpenProcess
SSDT AC1651BD ZwOpenThread
SSDT AC1651C7 ZwTerminateProcess

Code 85866410 ZwEnumerateKey
Code 8586E318 ZwFlushInstructionCache
Code 858664BD IofCallDriver
Code 858E5FD6 IofCompleteRequest

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\gxvxcptyoxfxusanhfikvnsgtnqxmnbwqmjpu.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\iexplore.exe [4980] 0x10000000

—- EOF - GMER 1.0.15 —-



Now on to the command for the programs list. It told me it was not found and to make sure I typed it right. I copied and pasted it directly from your post. Also I downloaded the avira you recommended and ran that before I even started anything else. :pullhair: Oh also…after I posted that last night, my pc got worse today. Pop-ups were coming so fast that it froze up. About 65 of them in 30-45 seconds. Sweet, huh? Maybe running the avira this evening helped, too soon to tell.
Post #4
Hi
Apologies for the late reply.

Now on to the command for the programs list. It told me it was not found and to make sure I typed it right. I copied and pasted it directly from your post.

This is because Combfix didn't run.

We'll try Combofix again but this time don't rename it.
Combofix
Delete the copy of Combofix you have & download it again from one of these locations:
Link 1
Link 2
Link 3

**IMPORTANT !!! Save ComboFix.exe to your Desktop**

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    A guide to do this can be found here
  • Right-click on ComboFix.exe then choose Run as Administrator to run the program & follow the prompts
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you have success with Combofix try for the Add-Remove Programs list again:
Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open. Post the contents of that file in your next reply.

To post in next reply:
Combofix log
Add-Remove Programs log
Post #5
Yup, that worked. Here is the combo fix log:

ComboFix 09-05-13.01 - Best Buy 05/13/2009 18:07.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2429.1459 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Antispyware *disabled* (Updated) {E6205FC1-0887-499A-B32E-28EC26C0B637}
SP: BitDefender Antispyware *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Best Buy\AppData\Local\Microsoft\Windows\Temporary Internet Files\fbk.sts
c:\windows\system32\drivers\gxvxcvnqyfmgreditqdmdoxyrkmlrtpiwuiei.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcptyoxfxusanhfikvnsgtnqxmnbwqmjpu.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_GXVXCSERV.SYS


((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 22:01 . 2009-05-13 22:01 ——– d—–w c:\users\Best Buy\AppData\Local\AOL
2009-05-13 12:25 . 2009-05-13 12:47 ——– d—–w c:\programdata\sedebodu
2009-05-13 12:25 . 2009-05-13 12:25 ——– d—–w c:\programdata\yumokene
2009-05-13 12:25 . 2009-05-13 12:47 ——– d—–w c:\users\All Users\sedebodu
2009-05-13 12:25 . 2009-05-13 12:25 ——– d—–w c:\users\All Users\yumokene
2009-05-12 23:32 . 2009-03-24 20:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\program files\Avira
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\programdata\Avira
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\users\All Users\Avira
2009-05-12 23:26 . 2009-05-12 23:48 ——– d—–w c:\programdata\yafakeje
2009-05-12 23:26 . 2009-05-12 23:48 ——– d—–w c:\users\All Users\yafakeje
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\programdata\dibebino
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\programdata\sodiluha
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\users\All Users\dibebino
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\users\All Users\sodiluha
2009-05-12 02:30 . 2009-05-12 02:34 ——– d—–w c:\users\Best Buy\DoctorWeb
2009-05-12 02:20 . 2009-05-12 02:20 ——– d—–w c:\users\Best Buy\AppData\Local\AOL(37)
2009-05-11 08:51 . 2009-05-12 21:29 ——– d—–w c:\programdata\lubeyapo
2009-05-11 08:51 . 2009-05-12 21:29 ——– d—–w c:\users\All Users\lubeyapo
2009-05-11 08:51 . 2009-05-11 08:51 ——– d—–w c:\programdata\viziyiri
2009-05-11 08:51 . 2009-05-11 08:51 ——– d—–w c:\users\All Users\viziyiri
2009-05-11 01:30 . 2009-05-11 01:30 ——– d—–w c:\program files\Trend Micro
2009-05-10 18:43 . 2009-05-10 18:43 ——– d—–w c:\programdata\zigevuya
2009-05-10 18:43 . 2009-05-10 18:43 ——– d—–w c:\users\All Users\zigevuya
2009-05-10 18:43 . 2009-05-12 21:29 ——– d—–w c:\programdata\lupawavi
2009-05-10 18:43 . 2009-05-10 18:43 ——– d—–w c:\programdata\pekimoka
2009-05-10 18:43 . 2009-05-12 21:29 ——– d—–w c:\users\All Users\lupawavi
2009-05-10 18:43 . 2009-05-10 18:43 ——– d—–w c:\users\All Users\pekimoka
2009-05-08 16:23 . 2009-05-08 16:23 ——– d—–w c:\programdata\Citrix
2009-05-08 16:23 . 2009-05-08 16:23 ——– d—–w c:\users\All Users\Citrix
2009-05-08 16:19 . 2009-05-08 16:19 ——– d—–w c:\users\Best Buy\AppData\Local\Citrix
2009-05-08 16:19 . 2009-05-08 16:19 61224 —-a-w c:\users\Best Buy\GoToAssistDownloadHelper.exe
2009-05-08 16:18 . 2009-05-08 16:18 ——– d—–w c:\users\Best Buy\AppData\Local\Apps
2009-05-08 16:18 . 2009-05-08 16:19 ——– d—–w c:\users\Best Buy\AppData\Local\Deployment
2009-05-08 11:53 . 2009-05-08 11:53 ——– d—–w c:\programdata\pavereye
2009-05-08 11:53 . 2009-05-08 12:15 ——– d—–w c:\programdata\ruwetivu
2009-05-08 11:53 . 2009-05-08 11:53 ——– d—–w c:\users\All Users\pavereye
2009-05-08 11:53 . 2009-05-08 12:15 ——– d—–w c:\users\All Users\ruwetivu
2009-05-07 23:53 . 2009-05-08 00:15 ——– d—–w c:\programdata\nuyafeku
2009-05-07 23:53 . 2009-05-08 00:15 ——– d—–w c:\users\All Users\nuyafeku
2009-05-07 23:53 . 2009-05-07 23:53 ——– d—–w c:\programdata\rufozeri
2009-05-07 23:53 . 2009-05-07 23:53 ——– d—–w c:\users\All Users\rufozeri
2009-05-07 22:32 . 2009-05-13 00:10 ——– d—–w c:\users\Best Buy\AppData\Roaming\Move Networks
2009-05-07 11:54 . 2009-05-07 12:15 ——– d—–w c:\programdata\goveyudi
2009-05-07 11:54 . 2009-05-07 11:54 ——– d—–w c:\programdata\wiyudesu
2009-05-07 11:54 . 2009-05-07 12:15 ——– d—–w c:\users\All Users\goveyudi
2009-05-07 11:54 . 2009-05-07 11:54 ——– d—–w c:\users\All Users\wiyudesu
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\programdata\matuyavu
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\programdata\newuyane
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\programdata\zebipubo
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\users\All Users\matuyavu
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\users\All Users\newuyane
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\users\All Users\zebipubo
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\programdata\duyasuwi
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\users\All Users\duyasuwi
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\programdata\kitugibi
2009-05-06 22:22 . 2009-05-06 22:22 ——– d—–w c:\users\All Users\kitugibi
2009-05-06 22:22 . 2009-05-12 21:29 ——– d—–w c:\programdata\pasihawo
2009-05-06 22:22 . 2009-05-12 21:29 ——– d—–w c:\users\All Users\pasihawo
2009-05-06 03:36 . 2009-05-12 21:29 ——– d—–w c:\programdata\kavinepe
2009-05-06 03:36 . 2009-05-12 21:29 ——– d—–w c:\programdata\pivejehu
2009-05-06 03:36 . 2009-05-12 21:29 ——– d—–w c:\users\All Users\kavinepe
2009-05-06 03:36 . 2009-05-12 21:29 ——– d—–w c:\users\All Users\pivejehu
2009-05-06 03:36 . 2009-05-06 03:56 ——– d—–w c:\programdata\rebawiza
2009-05-06 03:36 . 2009-05-06 03:56 ——– d—–w c:\users\All Users\rebawiza
2009-05-06 03:32 . 2009-05-13 00:13 ——– d—–w c:\users\Best Buy\AppData\Roaming\ptidle
2009-05-06 03:31 . 2009-05-12 02:50 ——– d—–w c:\programdata\sevikuji
2009-05-06 03:31 . 2009-05-12 02:50 ——– d—–w c:\users\All Users\sevikuji
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\programdata\futoyiyi
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\users\All Users\futoyiyi
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\programdata\lelasuba
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\users\All Users\lelasuba
2009-05-06 03:11 . 2009-05-06 03:11 ——– d—–w c:\users\Best Buy\AppData\Roaming\BitDefender
2009-05-06 03:10 . 2009-05-06 03:14 ——– d—–w c:\programdata\BitDefender
2009-05-06 03:10 . 2009-05-06 03:14 ——– d—–w c:\users\All Users\BitDefender
2009-05-06 03:10 . 2009-05-06 03:10 ——– d—–w c:\program files\BitDefender
2009-05-06 03:05 . 2009-05-07 20:59 ——– d—–w c:\program files\Common Files\BitDefender
2009-04-21 01:56 . 2009-04-21 01:56 ——– d—–w c:\users\All Users\Google
2009-04-18 05:29 . 2009-04-18 05:29 ——– d—–w c:\program files\Common Files\supportsoft
2009-04-18 05:29 . 2009-04-18 05:29 ——– d—–w c:\program files\providerComcast
2009-04-18 04:11 . 2009-04-18 04:12 ——– d—–w c:\program files\Common Files\Scanner
2009-04-18 04:11 . 2009-04-18 05:54 ——– d—–w c:\program files\ComcastToolbar
2009-04-18 03:57 . 2009-04-18 03:57 ——– d—–w c:\users\Best Buy\AppData\Roaming\Antispyware
2009-04-18 03:53 . 2009-05-06 03:07 ——– d—a-w c:\programdata\TEMP
2009-04-18 03:53 . 2009-05-06 03:07 ——– d—a-w c:\users\All Users\TEMP
2009-04-18 00:45 . 2009-04-18 00:46 ——– d—–w c:\programdata\Lavasoft
2009-04-18 00:45 . 2009-04-18 00:46 ——– d—–w c:\users\All Users\Lavasoft
2009-04-15 00:51 . 2009-03-03 04:40 827392 —-a-w c:\windows\system32\wininet.dll
2009-04-15 00:51 . 2009-03-03 02:28 26624 —-a-w c:\windows\system32\ieUnatt.exe
2009-04-15 00:51 . 2009-03-03 04:37 78336 —-a-w c:\windows\system32\ieencode.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 21:29 . 2009-03-16 14:34 ——– d—–w c:\program files\Yahoo!
2009-05-12 02:06 . 2008-02-27 02:19 ——– d—–w c:\program files\Java
2009-04-21 01:56 . 2008-02-27 02:14 ——– d—–w c:\program files\Google
2009-04-18 05:18 . 2008-02-27 01:50 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-04-18 05:17 . 2006-11-02 10:25 51200 —-a-w c:\windows\inf\infpub.dat
2009-04-18 05:17 . 2006-11-02 10:25 86016 —-a-w c:\windows\inf\infstrng.dat
2009-04-18 05:16 . 2006-11-02 10:25 86016 —-a-w c:\windows\inf\infstor.dat
2009-04-15 07:09 . 2006-11-02 11:18 ——– d—–w c:\program files\Windows Mail
2009-04-02 10:11 . 2008-06-29 16:52 1090 —-a-w c:\users\Best Buy\AppData\Roaming\wklnhst.dat
2009-03-28 04:55 . 2009-03-28 04:52 ——– d—–w c:\program files\Rhapsody
2009-03-28 04:53 . 2009-03-28 04:53 ——– d—–w c:\program files\Common Files\Real
2009-03-28 04:31 . 2009-03-28 04:31 ——– d—–w c:\program files\Real
2009-03-28 03:16 . 2009-03-28 03:16 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-03-27 13:01 . 2009-03-27 13:00 ——– d—–w c:\program files\Windows Live Safety Center
2009-03-17 03:38 . 2009-04-15 00:52 13824 —-a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 00:52 24064 —-a-w c:\windows\system32\amxread.dll
2009-03-15 15:33 . 2009-03-15 15:33 ——– d—–w c:\program files\Microsoft
2009-03-03 04:46 . 2009-04-15 00:52 3599328 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 00:52 3547632 —-a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-15 00:52 183296 —-a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 00:52 551424 —-a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 00:52 26112 —-a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 00:52 98304 —-a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 00:52 54784 —-a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 00:52 44032 —-a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 00:52 666624 —-a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 00:52 17408 —-a-w c:\windows\system32\iashost.exe
2009-02-13 08:49 . 2009-04-15 00:52 72704 —-a-w c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-15 00:52 1255936 —-a-w c:\windows\system32\lsasrv.dll
2008-01-21 02:43 . 2006-11-02 12:50 174 –sha-w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-21 50472]
"SmileboxTray"="c:\users\Best Buy\AppData\Roaming\Smilebox\SmileboxTray.exe" [2009-02-24 254600]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-21 39408]
"lewesazera"="c:\programdata\zebipubo\zebipubo.dll" [2009-02-06 48640]
"64e81f28"="c:\programdata\sedebodu\sedebodu.dll" [2009-05-13 80384]
"CPM67db2cb4"="c:\programdata\yumokene\yumokene.dll" [2009-05-13 87040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 815104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-04-21 68592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2007-07-27 405504]

c:\users\Best Buy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{84350710-1BF5-4148-B122-06F3DF847DD2}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{09563DAE-FB2F-4B4A-83A7-6EF2E99D3484}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AFF7C80F-4632-4074-90D0-77A3333C063D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E717433F-95E5-4FA9-BD79-A3A3273B816B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{3500DCFE-FE8C-45CC-BF5B-006E5C1BDB2A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{5E466F34-26B6-408A-91EB-38DFE3322F72}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{874E32A4-B331-464F-8C24-B362F22AD656}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{1C938649-1BB3-4DED-981F-BEFB2491B60B}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{02530F07-BBEC-4B16-B783-A9AD071EA7A3}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{098417C2-6813-47B1-B5DC-702CA0946DD4}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{3F89E67D-B70D-4D22-AE5B-963852FA1AA9}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{00D1A9A6-E8E0-42D3-AF9F-0BEFE96E4D54}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F41E8C5D-90F9-42B3-BDC8-A351375CFD8E}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{D3C0502A-5B61-4126-993A-44A3C653F0C1}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{3344A9B0-C209-458E-8AAA-E323C2D7F56D}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{01396E59-B3F8-4924-9BC5-839016EA7B05}c:\\program files\\rhapsody\\rhapsody.exe"= UDP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"UDP Query User{03FBAAD4-1EAB-40E1-9F4D-88BDD933E36F}c:\\program files\\rhapsody\\rhapsody.exe"= TCP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/12/2009 7:32 PM 108289]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [1/14/2009 5:53 PM 226656]
R2 tgsrvc_providercomcast;SupportSoft Repair Service (providercomcast);c:\program files\providerComcast\bin\tgsrvc.exe [5/2/2008 12:40 PM 148768]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/4/2008 10:38 PM 24652]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187B.sys [2/26/2008 10:02 PM 253952]
S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [11/2/2006 6:25 AM 2589184]
.
Contents of the 'Scheduled Tasks' folder

2009-05-13 c:\windows\Tasks\User_Feed_Synchronization-{E58B0A29-C435-4040-B830-1BC6E81E1667}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Antispyware - c:\program files\Antispyware\Antispyware.exe
HKCU-Run-ptidle - c:\users\Best Buy\AppData\Roaming\ptidle\ptidle.exe
Notify-DfLogon - LogonDll.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-1628
uInternet Settings,ProxyOverride = *.local
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 18:21
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2009-05-13 18:22
ComboFix-quarantined-files.txt 2009-05-13 22:22

Pre-Run: 177,330,323,456 bytes free
Post-Run: 177,357,529,088 bytes free

244 — E O F — 2009-04-15 07:04



Here is the program list:

2007 Microsoft Office Suite Service Pack 1 (SP1)
Activation Assistant for the 2007 Microsoft Office suites
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.2
Agere Systems HDA Modem
AIM 6
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
Avira AntiVir Personal - Free Antivirus
Bonjour
Browser Address Error Redirector
Camera Assistant Software for Gateway
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Comcast User Setup
Compatibility Pack for the 2007 Office system
Gateway Connect
Gateway Games
Gateway Recovery Center Installer
Geek Squad 24 Hour Computer Support
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
IDT Audio
InstallMgr
iTunes
LabelPrint
Microsoft .NET Framework 3.5 SP1
Microsoft Default Manager
Microsoft Money Essentials
Microsoft Money Shared Libraries
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
MSN Toolbar
Power2Go 5.0
QuickTime
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
Realtek USB 2.0 Card Reader
REALTEK USB Wireless LAN Driver
Rhapsody
Rhapsody MP3 Download Manager
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB960003)
Security Update for Microsoft Office Excel 2007 (KB959997)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Skins
Smilebox
Synaptics Pointing Device Driver
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Office 2007 (KB946691)
Viewpoint Media Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Windows Live Messenger
Windows Live OneCare safety scanner
Post #6
Hi
Still got quite a bit to do here.

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

http://forums.whatthetech.com/my_log_file_help_t102990.html
SecCenter::
{E6205FC1-0887-499A-B32E-28EC26C0B637}
Collect::
c:\programdata\zebipubo\zebipubo.dll
c:\programdata\sedebodu\sedebodu.dll
c:\programdata\yumokene\yumokene.dll
DirLook::
c:\users\All Users\sedebodu
c:\users\All Users\yumokene
c:\programdata\yafakeje
c:\users\All Users\yafakeje
c:\programdata\dibebino
c:\programdata\sodiluha
c:\users\All Users\dibebino
c:\users\All Users\sodiluha
c:\programdata\lubeyapo
c:\users\All Users\lubeyapo
c:\programdata\viziyiri
c:\users\All Users\viziyiri
c:\programdata\zigevuya
c:\users\All Users\zigevuya
c:\programdata\lupawavi
c:\programdata\pekimoka
c:\users\All Users\lupawavi
c:\users\All Users\pekimoka
c:\programdata\pavereye
c:\programdata\ruwetivu
c:\users\All Users\pavereye
c:\users\All Users\ruwetivu
c:\programdata\nuyafeku
c:\users\All Users\nuyafeku
c:\programdata\rufozeri
c:\users\All Users\rufozeri
c:\programdata\goveyudi
c:\programdata\wiyudesu
c:\users\All Users\goveyudi
c:\users\All Users\wiyudesu
c:\programdata\matuyavu
c:\programdata\newuyane
c:\users\All Users\matuyavu
c:\users\All Users\newuyane
c:\users\All Users\zebipubo
c:\programdata\duyasuwi
c:\users\All Users\duyasuwi
c:\programdata\kitugibi
c:\users\All Users\kitugibi
c:\programdata\pasihawo
c:\users\All Users\pasihawo
c:\programdata\kavinepe
c:\programdata\pivejehu
c:\users\All Users\kavinepe
c:\users\All Users\pivejehu
c:\programdata\rebawiza
c:\users\All Users\rebawiza
c:\programdata\sevikuji
c:\users\All Users\sevikuji
c:\programdata\futoyiyi
c:\users\All Users\futoyiyi
c:\programdata\lelasuba
c:\users\All Users\lelasuba
c:\program files\Common Files\Scanner
Folder::
c:\programdata\zebipubo
c:\programdata\sedebodu
c:\programdata\yumokene
c:\users\Best Buy\AppData\Roaming\ptidle
c:\users\Best Buy\AppData\Roaming\Antispyware
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lewesazera"=-
"64e81f28"=-
"CPM67db2cb4"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Could you also run Gmer again using instructions previously posted.

To post in next reply:
Combofix log (NOTE: The resulting log will be quite large. If it is too large for one reply you can either split up over a couple of posts or Attach the log as an Attachment)
New Gmer log
Post #7
combofix log is as follows:

ComboFix 09-05-14.03 - Best Buy 05/14/2009 20:15.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2429.1522 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Best Buy\Desktop\CFScript.txt
SP: Antispyware *disabled* (Updated) {E6205FC1-0887-499A-B32E-28EC26C0B637}
SP: BitDefender Antispyware *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

file zipped: c:\programdata\sedebodu\sedebodu.dll
file zipped: c:\programdata\yumokene\yumokene.dll
file zipped: c:\programdata\zebipubo\zebipubo.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\sedebodu
c:\programdata\sedebodu\sedebodu.dll
c:\programdata\sedebodu\udobedes.ini
c:\programdata\yumokene
c:\programdata\yumokene\yumokene.dll
c:\programdata\zebipubo
c:\programdata\zebipubo\zebipubo.dll
c:\users\Best Buy\AppData\Roaming\Antispyware
c:\users\Best Buy\AppData\Roaming\Antispyware\Log\2009 Apr 17 - 11_57_48 PM_653.log
c:\users\Best Buy\AppData\Roaming\Antispyware\rs.dat
c:\users\Best Buy\AppData\Roaming\Antispyware\Settings\ScanResults.pie
c:\users\Best Buy\AppData\Roaming\ptidle

.
((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.

2009-05-13 22:01 . 2009-05-13 22:01 ——– d—–w c:\users\Best Buy\AppData\Local\AOL
2009-05-12 23:32 . 2009-03-24 20:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\program files\Avira
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\programdata\Avira
2009-05-12 23:32 . 2009-05-12 23:32 ——– d—–w c:\users\All Users\Avira
2009-05-12 23:26 . 2009-05-12 23:48 ——– d—–w c:\programdata\yafakeje
2009-05-12 23:26 . 2009-05-12 23:48 ——– d—–w c:\users\All Users\yafakeje
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\programdata\dibebino
2009-05-12 23:26 . 2009-05-13 01:20 ——– d—–w c:\programdata\sodiluha
2009-05-12 23:26 . 2009-05-12 23:26 ——– d—–w c:\users\All Users\dibebino
2009-05-12 23:26 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\sodiluha
2009-05-12 02:30 . 2009-05-12 02:34 ——– d—–w c:\users\Best Buy\DoctorWeb
2009-05-12 02:20 . 2009-05-12 02:20 ——– d—–w c:\users\Best Buy\AppData\Local\AOL(37)
2009-05-11 08:51 . 2009-05-13 01:19 ——– d—–w c:\programdata\lubeyapo
2009-05-11 08:51 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\lubeyapo
2009-05-11 08:51 . 2009-05-13 01:20 ——– d—–w c:\programdata\viziyiri
2009-05-11 08:51 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\viziyiri
2009-05-11 01:30 . 2009-05-11 01:30 ——– d—–w c:\program files\Trend Micro
2009-05-10 18:43 . 2009-05-13 01:20 ——– d—–w c:\programdata\zigevuya
2009-05-10 18:43 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\zigevuya
2009-05-10 18:43 . 2009-05-13 01:19 ——– d—–w c:\programdata\lupawavi
2009-05-10 18:43 . 2009-05-13 01:20 ——– d—–w c:\programdata\pekimoka
2009-05-10 18:43 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\lupawavi
2009-05-10 18:43 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\pekimoka
2009-05-08 16:23 . 2009-05-08 16:23 ——– d—–w c:\programdata\Citrix
2009-05-08 16:23 . 2009-05-08 16:23 ——– d—–w c:\users\All Users\Citrix
2009-05-08 16:19 . 2009-05-08 16:19 ——– d—–w c:\users\Best Buy\AppData\Local\Citrix
2009-05-08 16:19 . 2009-05-08 16:19 61224 —-a-w c:\users\Best Buy\GoToAssistDownloadHelper.exe
2009-05-08 16:18 . 2009-05-08 16:18 ——– d—–w c:\users\Best Buy\AppData\Local\Apps
2009-05-08 16:18 . 2009-05-08 16:19 ——– d—–w c:\users\Best Buy\AppData\Local\Deployment
2009-05-08 11:53 . 2009-05-13 01:20 ——– d—–w c:\programdata\pavereye
2009-05-08 11:53 . 2009-05-13 01:20 ——– d—–w c:\programdata\ruwetivu
2009-05-08 11:53 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\pavereye
2009-05-08 11:53 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\ruwetivu
2009-05-07 23:53 . 2009-05-13 01:19 ——– d—–w c:\programdata\nuyafeku
2009-05-07 23:53 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\nuyafeku
2009-05-07 23:53 . 2009-05-13 01:20 ——– d—–w c:\programdata\rufozeri
2009-05-07 23:53 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\rufozeri
2009-05-07 22:32 . 2009-05-13 00:10 ——– d—–w c:\users\Best Buy\AppData\Roaming\Move Networks
2009-05-07 11:54 . 2009-05-13 01:19 ——– d—–w c:\programdata\goveyudi
2009-05-07 11:54 . 2009-05-13 01:20 ——– d—–w c:\programdata\wiyudesu
2009-05-07 11:54 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\goveyudi
2009-05-07 11:54 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\wiyudesu
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\programdata\matuyavu
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\programdata\newuyane
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\matuyavu
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\newuyane
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\programdata\duyasuwi
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\duyasuwi
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\programdata\kitugibi
2009-05-06 22:22 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\kitugibi
2009-05-06 22:22 . 2009-05-13 01:20 ——– d—–w c:\programdata\pasihawo
2009-05-06 22:22 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\pasihawo
2009-05-06 03:36 . 2009-05-13 01:19 ——– d—–w c:\programdata\kavinepe
2009-05-06 03:36 . 2009-05-13 01:20 ——– d—–w c:\programdata\pivejehu
2009-05-06 03:36 . 2009-05-13 01:19 ——– d—–w c:\users\All Users\kavinepe
2009-05-06 03:36 . 2009-05-13 01:20 ——– d—–w c:\users\All Users\pivejehu
2009-05-06 03:36 . 2009-05-06 03:56 ——– d—–w c:\programdata\rebawiza
2009-05-06 03:36 . 2009-05-06 03:56 ——– d—–w c:\users\All Users\rebawiza
2009-05-06 03:31 . 2009-05-12 02:50 ——– d—–w c:\programdata\sevikuji
2009-05-06 03:31 . 2009-05-12 02:50 ——– d—–w c:\users\All Users\sevikuji
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\programdata\futoyiyi
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\users\All Users\futoyiyi
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\programdata\lelasuba
2009-05-06 03:31 . 2009-05-12 02:49 ——– d—–w c:\users\All Users\lelasuba
2009-05-06 03:11 . 2009-05-06 03:11 ——– d—–w c:\users\Best Buy\AppData\Roaming\BitDefender
2009-05-06 03:10 . 2009-05-06 03:14 ——– d—–w c:\programdata\BitDefender
2009-05-06 03:10 . 2009-05-06 03:14 ——– d—–w c:\users\All Users\BitDefender
2009-05-06 03:10 . 2009-05-06 03:10 ——– d—–w c:\program files\BitDefender
2009-05-06 03:05 . 2009-05-07 20:59 ——– d—–w c:\program files\Common Files\BitDefender
2009-04-21 01:56 . 2009-04-21 01:56 ——– d—–w c:\users\All Users\Google
2009-04-18 05:29 . 2009-04-18 05:29 ——– d—–w c:\program files\Common Files\supportsoft
2009-04-18 05:29 . 2009-04-18 05:29 ——– d—–w c:\program files\providerComcast
2009-04-18 04:11 . 2009-04-18 04:12 ——– d—–w c:\program files\Common Files\Scanner
2009-04-18 04:11 . 2009-04-18 05:54 ——– d—–w c:\program files\ComcastToolbar
2009-04-18 03:53 . 2009-05-06 03:07 ——– d—a-w c:\programdata\TEMP
2009-04-18 03:53 . 2009-05-06 03:07 ——– d—a-w c:\users\All Users\TEMP
2009-04-18 00:45 . 2009-04-18 00:46 ——– d—–w c:\programdata\Lavasoft
2009-04-18 00:45 . 2009-04-18 00:46 ——– d—–w c:\users\All Users\Lavasoft
2009-04-15 00:51 . 2009-03-03 04:40 827392 —-a-w c:\windows\system32\wininet.dll
2009-04-15 00:51 . 2009-03-03 02:28 26624 —-a-w c:\windows\system32\ieUnatt.exe
2009-04-15 00:51 . 2009-03-03 04:37 78336 —-a-w c:\windows\system32\ieencode.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 21:29 . 2009-03-16 14:34 ——– d—–w c:\program files\Yahoo!
2009-05-12 02:06 . 2008-02-27 02:19 ——– d—–w c:\program files\Java
2009-04-21 01:56 . 2008-02-27 02:14 ——– d—–w c:\program files\Google
2009-04-18 05:18 . 2008-02-27 01:50 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-04-15 07:09 . 2006-11-02 11:18 ——– d—–w c:\program files\Windows Mail
2009-04-02 10:11 . 2008-06-29 16:52 1090 —-a-w c:\users\Best Buy\AppData\Roaming\wklnhst.dat
2009-03-28 04:55 . 2009-03-28 04:52 ——– d—–w c:\program files\Rhapsody
2009-03-28 04:53 . 2009-03-28 04:53 ——– d—–w c:\program files\Common Files\Real
2009-03-28 04:31 . 2009-03-28 04:31 ——– d—–w c:\program files\Real
2009-03-28 03:16 . 2009-03-28 03:16 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-03-27 13:01 . 2009-03-27 13:00 ——– d—–w c:\program files\Windows Live Safety Center
2009-03-17 03:38 . 2009-04-15 00:52 13824 —-a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 00:52 24064 —-a-w c:\windows\system32\amxread.dll
2009-03-03 04:46 . 2009-04-15 00:52 3599328 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 00:52 3547632 —-a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-15 00:52 183296 —-a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 00:52 551424 —-a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 00:52 26112 —-a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 00:52 98304 —-a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 00:52 54784 —-a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 00:52 44032 —-a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 00:52 666624 —-a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 00:52 17408 —-a-w c:\windows\system32\iashost.exe
2008-01-21 02:43 . 2006-11-02 12:50 174 –sha-w c:\program files\desktop.ini
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\program files\Common Files\Scanner —-

2009-04-18 04:12 . 2009-04-18 04:12 32 —-a-w c:\program files\Common Files\Scanner\Quarantine\ppqdb.dat
2009-04-18 04:12 . 2009-04-18 04:12 32 —-a-w c:\program files\Common Files\Scanner\Quarantine\ppqsdb.dat
2007-02-08 14:15 . 2007-02-08 14:15 695024 —-a-w c:\program files\Common Files\Scanner\AntiSpy.exe
2006-12-12 19:13 . 2006-12-12 19:13 800272 —-a-w c:\program files\Common Files\Scanner\ppctl.dll
2006-12-12 17:34 . 2009-04-18 04:14 462 —-a-w c:\program files\Common Files\Scanner\lfinfo.dat
2006-12-12 17:34 . 2009-04-18 04:14 1719270 —-a-w c:\program files\Common Files\Scanner\ppinfo.dat
2006-12-12 17:33 . 2009-04-18 04:14 993622 —-a-w c:\program files\Common Files\Scanner\pploc.dat
2006-12-12 17:33 . 2006-12-12 17:33 229566 —-a-w c:\program files\Common Files\Scanner\pplogo.bmp
2006-12-12 17:33 . 2009-04-18 04:12 35745 —-a-w c:\program files\Common Files\Scanner\ppsrindex.dat
2006-12-12 17:33 . 2009-04-18 04:12 541509 —-a-w c:\program files\Common Files\Scanner\ppclean.exe
2006-01-23 16:52 . 2009-04-18 04:17 60 —-a-w c:\program files\Common Files\Scanner\cfg.ini
2006-01-23 16:51 . 2006-01-23 16:51 2239 —-a-w c:\program files\Common Files\Scanner\res.ini
2005-11-30 18:59 . 2005-11-30 18:59 9382 —-a-w c:\program files\Common Files\Scanner\top.bmp
2005-11-25 15:25 . 2005-11-25 15:25 2 —-a-w c:\program files\Common Files\Scanner\ppv5exc.dat
2005-11-03 20:20 . 2005-11-03 20:20 822 —-a-w c:\program files\Common Files\Scanner\update.bmp
2005-09-21 19:59 . 2005-09-21 19:59 25214 —-a-w c:\program files\Common Files\Scanner\ppicon.ico
2005-01-27 17:28 . 2009-04-18 04:13 7738786 —-a-w c:\program files\Common Files\Scanner\ppfile.dat
2003-10-09 04:23 . 2003-10-09 04:23 58 —-a-w c:\program files\Common Files\Scanner\PestPatrol.bin
2003-05-05 11:44 . 2003-05-05 11:44 7332 —-a-w c:\program files\Common Files\Scanner\langv5.dat
2003-03-19 01:14 . 2003-03-19 01:14 499712 —-a-w c:\program files\Common Files\Scanner\msvcp71.dll
2003-02-21 09:42 . 2003-02-21 09:42 348160 —-a-w c:\program files\Common Files\Scanner\msvcr71.dll

—- Directory of c:\programdata\dibebino —-

2009-02-12 23:26 . 2009-05-12 23:26 86528 –sha-w c:\programdata\dibebino\dibebino.dll

—- Directory of c:\programdata\duyasuwi —-


—- Directory of c:\programdata\futoyiyi —-


—- Directory of c:\programdata\goveyudi —-

2009-05-07 11:54 . 2009-05-07 12:15 1406496 –sh–w c:\programdata\goveyudi\iduyevog.ini

—- Directory of c:\programdata\kavinepe —-


—- Directory of c:\programdata\kitugibi —-


—- Directory of c:\programdata\lelasuba —-


—- Directory of c:\programdata\lubeyapo —-

2009-05-11 08:52 . 2009-05-11 10:52 1406496 –sh–w c:\programdata\lubeyapo\opayebul.ini

—- Directory of c:\programdata\lupawavi —-


—- Directory of c:\programdata\matuyavu —-


—- Directory of c:\programdata\newuyane —-


—- Directory of c:\programdata\nuyafeku —-

2009-05-07 23:53 . 2009-05-08 00:15 1433831 –sh–w c:\programdata\nuyafeku\ukefayun.ini

—- Directory of c:\programdata\pasihawo —-


—- Directory of c:\programdata\pavereye —-


—- Directory of c:\programdata\pekimoka —-


—- Directory of c:\programdata\pivejehu —-

2009-05-06 03:37 . 2009-05-06 04:04 1406514 –sh–w c:\programdata\pivejehu\uhejevip.ini

—- Directory of c:\programdata\rebawiza —-


—- Directory of c:\programdata\rufozeri —-


—- Directory of c:\programdata\ruwetivu —-

2009-05-08 11:53 . 2009-05-08 12:15 1433831 –sh–w c:\programdata\ruwetivu\uvitewur.ini

—- Directory of c:\programdata\sevikuji —-


—- Directory of c:\programdata\sodiluha —-


—- Directory of c:\programdata\viziyiri —-


—- Directory of c:\programdata\wiyudesu —-


—- Directory of c:\programdata\yafakeje —-

2009-05-12 23:26 . 2009-05-12 23:48 1433831 –sh–w c:\programdata\yafakeje\ejekafay.ini
2009-02-12 23:26 . 2009-05-12 23:26 79872 ——w c:\programdata\yafakeje\yafakeje.dll

—- Directory of c:\programdata\zigevuya —-


—- Directory of c:\users\All Users\dibebino —-

2009-02-12 23:26 . 2009-05-12 23:26 86528 –sha-w c:\users\All Users\dibebino\dibebino.dll

—- Directory of c:\users\All Users\duyasuwi —-


—- Directory of c:\users\All Users\futoyiyi —-


—- Directory of c:\users\All Users\goveyudi —-

2009-05-07 11:54 . 2009-05-07 12:15 1406496 –sh–w c:\users\All Users\goveyudi\iduyevog.ini

—- Directory of c:\users\All Users\kavinepe —-


—- Directory of c:\users\All Users\kitugibi —-


—- Directory of c:\users\All Users\lelasuba —-


—- Directory of c:\users\All Users\lubeyapo —-

2009-05-11 08:52 . 2009-05-11 10:52 1406496 –sh–w c:\users\All Users\lubeyapo\opayebul.ini

—- Directory of c:\users\All Users\lupawavi —-


—- Directory of c:\users\All Users\matuyavu —-


—- Directory of c:\users\All Users\newuyane —-


—- Directory of c:\users\All Users\nuyafeku —-

2009-05-07 23:53 . 2009-05-08 00:15 1433831 –sh–w c:\users\All Users\nuyafeku\ukefayun.ini

—- Directory of c:\users\All Users\pasihawo —-


—- Directory of c:\users\All Users\pavereye —-


—- Directory of c:\users\All Users\pekimoka —-


—- Directory of c:\users\All Users\pivejehu —-

2009-05-06 03:37 . 2009-05-06 04:04 1406514 –sh–w c:\users\All Users\pivejehu\uhejevip.ini

—- Directory of c:\users\All Users\rebawiza —-


—- Directory of c:\users\All Users\rufozeri —-


—- Directory of c:\users\All Users\ruwetivu —-

2009-05-08 11:53 . 2009-05-08 12:15 1433831 –sh–w c:\users\All Users\ruwetivu\uvitewur.ini

—- Directory of c:\users\All Users\sedebodu —-

2009-05-13 12:25 . 2009-05-13 12:47 1433831 –sh–w c:\users\All Users\sedebodu\udobedes.ini
2009-02-13 12:25 . 2009-05-15 00:15 80384 –sha-w c:\users\All Users\sedebodu\sedebodu.dll

—- Directory of c:\users\All Users\sevikuji —-


—- Directory of c:\users\All Users\sodiluha —-


—- Directory of c:\users\All Users\viziyiri —-


—- Directory of c:\users\All Users\wiyudesu —-


—- Directory of c:\users\All Users\yafakeje —-

2009-05-12 23:26 . 2009-05-12 23:48 1433831 –sh–w c:\users\All Users\yafakeje\ejekafay.ini
2009-02-12 23:26 . 2009-05-12 23:26 79872 ——w c:\users\All Users\yafakeje\yafakeje.dll

—- Directory of c:\users\All Users\yumokene —-

2009-02-13 12:25 . 2009-05-15 00:15 87040 –sha-w c:\users\All Users\yumokene\yumokene.dll

—- Directory of c:\users\All Users\zebipubo —-

2009-02-06 22:22 . 2009-05-15 00:15 48640 —-a-w c:\users\All Users\zebipubo\zebipubo.dll

—- Directory of c:\users\All Users\zigevuya —-



((((((((((((((((((((((((((((( SnapShot@2009-05-13_22.21.31 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-14 23:12 . 2009-05-13 22:11 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-14 23:12 . 2009-05-15 00:02 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-14 23:12 . 2009-05-15 00:02 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-14 23:12 . 2009-05-13 22:11 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-14 23:12 . 2009-05-13 22:11 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-04-14 23:12 . 2009-05-15 00:02 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-24 05:29 . 2009-05-15 00:00 330144 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 10:22 . 2009-05-14 08:22 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
- 2006-11-02 10:22 . 2009-05-12 23:31 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2009-05-15 00:15 . 2009-05-15 00:15 6258688 c:\windows\ERDNT\Hiv-backup\schema.dat
+ 2008-02-05 05:27 . 2009-05-14 08:22 101428240 c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-21 50472]
"SmileboxTray"="c:\users\Best Buy\AppData\Roaming\Smilebox\SmileboxTray.exe" [2009-02-24 254600]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-21 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 815104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-04-21 68592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2007-07-27 405504]

c:\users\Best Buy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{84350710-1BF5-4148-B122-06F3DF847DD2}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{09563DAE-FB2F-4B4A-83A7-6EF2E99D3484}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AFF7C80F-4632-4074-90D0-77A3333C063D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E717433F-95E5-4FA9-BD79-A3A3273B816B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{3500DCFE-FE8C-45CC-BF5B-006E5C1BDB2A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{5E466F34-26B6-408A-91EB-38DFE3322F72}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{874E32A4-B331-464F-8C24-B362F22AD656}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{1C938649-1BB3-4DED-981F-BEFB2491B60B}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{02530F07-BBEC-4B16-B783-A9AD071EA7A3}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{098417C2-6813-47B1-B5DC-702CA0946DD4}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{3F89E67D-B70D-4D22-AE5B-963852FA1AA9}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{00D1A9A6-E8E0-42D3-AF9F-0BEFE96E4D54}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F41E8C5D-90F9-42B3-BDC8-A351375CFD8E}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{D3C0502A-5B61-4126-993A-44A3C653F0C1}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{3344A9B0-C209-458E-8AAA-E323C2D7F56D}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{01396E59-B3F8-4924-9BC5-839016EA7B05}c:\\program files\\rhapsody\\rhapsody.exe"= UDP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"UDP Query User{03FBAAD4-1EAB-40E1-9F4D-88BDD933E36F}c:\\program files\\rhapsody\\rhapsody.exe"= TCP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/12/2009 7:32 PM 108289]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [1/14/2009 5:53 PM 226656]
R2 tgsrvc_providercomcast;SupportSoft Repair Service (providercomcast);c:\program files\providerComcast\bin\tgsrvc.exe [5/2/2008 12:40 PM 148768]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/4/2008 10:38 PM 24652]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187B.sys [2/26/2008 10:02 PM 253952]
S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [11/2/2006 6:25 AM 2589184]
.
Contents of the 'Scheduled Tasks' folder

2009-05-14 c:\windows\Tasks\User_Feed_Synchronization-{E58B0A29-C435-4040-B830-1BC6E81E1667}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-1628
uInternet Settings,ProxyOverride = *.local
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-14 20:18
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2009-05-15 20:19
ComboFix-quarantined-files.txt 2009-05-15 00:19
ComboFix2.txt 2009-05-13 22:22

Pre-Run: 177,474,715,648 bytes free
Post-Run: 177,452,118,016 bytes free

341 — E O F — 2009-05-15 00:01
Upload was successful



GMER log is as follows:

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-14 20:31:36
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

SSDT 9506F82C ZwCreateThread
SSDT 9506F818 ZwOpenProcess
SSDT 9506F81D ZwOpenThread
SSDT 9506F827 ZwTerminateProcess

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 31: copy of MBR

—- EOF - GMER 1.0.15 —-




Still quite a bit to do? That mean my pc was in pretty rough shape? lol.
Post #8

Still quite a bit to do? That mean my pc was in pretty rough shape? lol.

Hehe.. you could say that.

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

http://forums.whatthetech.com/my_log_file_help_t102990.html
SecCenter::
SP: Antispyware *disabled* (Updated) {E6205FC1-0887-499A-B32E-28EC26C0B637}
Collect::
c:\programdata\dibebino\dibebino.dll
c:\programdata\goveyudi\iduyevog.ini
c:\programdata\lubeyapo\opayebul.ini
c:\programdata\nuyafeku\ukefayun.ini
c:\programdata\pivejehu\uhejevip.ini
c:\programdata\ruwetivu\uvitewur.ini
c:\programdata\yafakeje\ejekafay.ini
c:\programdata\yafakeje\yafakeje.dll
c:\users\All Users\dibebino\dibebino.dll
c:\users\All Users\goveyudi\iduyevog.ini
c:\users\All Users\lubeyapo\opayebul.ini
c:\users\All Users\nuyafeku\ukefayun.ini
c:\users\All Users\pivejehu\uhejevip.ini
c:\users\All Users\ruwetivu\uvitewur.ini
c:\users\All Users\sedebodu\udobedes.ini
c:\users\All Users\sedebodu\sedebodu.dll
c:\users\All Users\yafakeje\ejekafay.ini
c:\users\All Users\yafakeje\yafakeje.dll
c:\users\All Users\yumokene\yumokene.dll
c:\users\All Users\zebipubo\zebipubo.dll
Folder::
c:\programdata\dibebino
c:\programdata\duyasuwi
c:\programdata\futoyiyi
c:\programdata\goveyudi
c:\programdata\kavinepe
c:\programdata\kitugibi
c:\programdata\lelasuba
c:\programdata\lubeyapo
c:\programdata\lupawavi
c:\programdata\matuyavu
c:\programdata\newuyane
c:\programdata\nuyafeku
c:\programdata\pasihawo
c:\programdata\pavereye
c:\programdata\pekimoka
c:\programdata\pivejehu
c:\programdata\rebawiza
c:\programdata\rufozeri
c:\programdata\ruwetivu
c:\programdata\sevikuji
c:\programdata\sodiluha
c:\programdata\viziyiri
c:\programdata\wiyudesu
c:\programdata\yafakeje
c:\programdata\zigevuya
c:\users\All Users\dibebino
c:\users\All Users\duyasuwi
c:\users\All Users\futoyiyi
c:\users\All Users\goveyudi
c:\users\All Users\kavinepe
c:\users\All Users\kitugibi
c:\users\All Users\lelasuba
c:\users\All Users\lubeyapo
c:\users\All Users\lupawavi
c:\users\All Users\matuyavu
c:\users\All Users\newuyane
c:\users\All Users\nuyafeku
c:\users\All Users\pasihawo
c:\users\All Users\pavereye
c:\users\All Users\pekimoka
c:\users\All Users\pivejehu
c:\users\All Users\rebawiza
c:\users\All Users\rufozeri
c:\users\All Users\ruwetivu
c:\users\All Users\sedebodu
c:\users\All Users\sevikuji
c:\users\All Users\sodiluha
c:\users\All Users\viziyiri
c:\users\All Users\wiyudesu
c:\users\All Users\yafakeje
c:\users\All Users\yumokene
c:\users\All Users\zebipubo
c:\users\All Users\zigevuya
Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Kaspersky Online Scan
Please make sure that all programs are closed when installing Java.

  • Click here to visit Java's website
  • Scroll down to Java Runtime Environment (JRE) 6 Update 13. Click on Download
  • Select Windows from the drop-down list for Platform
  • Select Multi-language from the drop-down list for Language
  • Check (tick) I agree to the Java SE Runtime Environment 6 License Agreement box and click on Continue
  • Click on jre-6u13-windows-i586-p.exe link to download it and save this to a convenient location
  • Right click on jre-6u13-windows-i586-p.exe and select Run As Administrator to install Java
  • After the Java installation has finished, right click on your favourite web browser (Internet Explorer, Firefox, etc) and select Run As Administrator to run it
  • Go to Kaspersky website and perform an online antivirus scan
  • Read through the requirements and privacy statement and click on Accept button
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
  • When the downloads have finished, click on Settings
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan
  • Once the scan is complete, it will display the results. Click on View Scan Report
  • You will see a list of infected items there. Click on Save Report As…
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
  • Please post this log in your next reply
To post in next reply:
Combofix log
Kaspersky Scan log
Update on how the computer is running / problems

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI