What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Can't get rid of this virus, please help me!

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I know this has been going around alot lately, but I've also heard that there are many different variations. I hope someone can help me. I use Firefox for internet browsing. I first noticed that my google search results were being redirected. I use CCleaner pretty frequently. I run Sunbelt VIPRE for my antivirus protection. However, the virus seems to be preventing VIPRE from updating it's definitions. Also, after researching this online I have seen several possible fixes via software downloads (antivirus, antispyware, antimalware, etc). However, anytime I try and visit any of the sites to download these products the virus won't even allow me to visit those URLs. I used another computer in our office to download the installer for Malwarebytes (I heard that it knocks out the google hijack). I did the install, but then when I tried to use the software, the virus seems to be preventing it as well. Please help, I'm so sick of fighting this thing with no result.

Hijack This:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:21 AM, on 5/20/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://online.americanbus.com/psp/fin89prd…;languageCd=ENG
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\320\g2mstart.exe "/Trigger RunAtLogon"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: autobahn.lnk = C:\ProgramData\Autobahn\autobahn.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: messenger.hotmail.com
O15 - Trusted Zone: loginnet.passport.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A4855E0-B760-4AE6-87AD-6F8DE11CFC73}: NameServer = 85.255.112.110,85.255.112.229
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.110,85.255.112.229
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.110,85.255.112.229
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: VIPRE Antivirus + Antispyware (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8883 bytes
Post #2
Hi,

Please do the following:

  • Open HijackThis.
  • Click Do a System Scan Only.
  • Put a checkmark in the box on the left side of these entries only:


    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8A4855E0-B760-4AE6-87AD-6F8DE11CFC73}: NameServer = 85.255.112.110,85.255.112.229
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.110,85.255.112.229
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.110,85.255.112.229

  • Close ALL windows and browsers except HijackThis and click "Fix checked"
  • Exit HijackThis

NEXT

Try and run the Malwarebytes program, post the resulting log if it runs.

Make sure you allow the MalwareBytes program to delete what it finds.
Post #3
Ran the Hijackthis fix. Tried again to run Malwarebytes, but nothing happens. I double-click the icon on the desktop and for a brief moment the cursor shows me the hourglass as if it's opening the program, then it changes back to my pointer and nothing happens.
Post #4
OK,

Then please do the following:

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–

Double click on Combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt back into this thread.
Post #5
ComboFix 09-05-19.08 - od 05/20/2009 12:24.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3062.2088 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\Combo-Fix.exe.exe
AV: Sunbelt VIPRE *On-access scanning disabled* (Outdated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
SP: Sunbelt VIPRE *disabled* (Outdated) {9817B764-AE4E-4B29-AEE7-725B7A50BD48}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\DigitalLabs
c:\program files\DigitalLabs\Uninstall.exe
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\programdata\Microsoft\Windows\Start Menu\Programs\DigitalLabs
c:\programdata\Microsoft\Windows\Start Menu\Programs\DigitalLabs\Uninstall.lnk
c:\users\od\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalLabs
c:\windows\system32\drivers\gxvxcrqmpswrymxrprepxfxvppeqoswmpqins.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcifuhknubpidpnrwjxcdsgojbqybaoexw.dll
c:\windows\system32\x64

—– BITS: Possible infected sites —–

hxxp://updates.swarmcast.net
.
((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.

2009-05-20 15:59 . 2009-04-06 19:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 15:58 . 2009-04-06 19:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 15:58 . 2009-05-20 15:58 ——– d—–w c:\programdata\Malwarebytes
2009-05-20 15:58 . 2009-05-20 15:58 ——– d—–w c:\users\All Users\Malwarebytes
2009-05-20 15:58 . 2009-05-20 15:59 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-20 14:16 . 2009-05-20 14:16 ——– d—–w c:\program files\Trend Micro
2009-05-06 12:48 . 2009-05-06 12:48 ——– d—–w c:\programdata\Carbonite
2009-05-06 12:48 . 2009-05-06 12:48 ——– d—–w c:\users\All Users\Carbonite
2009-05-06 12:48 . 2009-05-06 12:48 ——– d—–w c:\program files\Carbonite

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 13:47 . 2008-10-15 12:40 ——– d—–w c:\program files\CCleaner
2009-05-08 16:22 . 2009-01-23 16:33 ——– d—–w c:\program files\SOS Online Backup
2009-04-20 12:32 . 2009-04-20 12:32 ——– d—–w c:\program files\iTunes
2009-04-20 12:32 . 2009-04-20 12:32 ——– d—–w c:\program files\iPod
2009-04-20 12:32 . 2008-09-29 18:04 ——– d—–w c:\program files\Common Files\Apple
2009-04-20 12:27 . 2008-07-31 21:45 ——– d—–w c:\program files\Bonjour
2009-04-17 07:10 . 2006-11-02 11:18 ——– d—–w c:\program files\Windows Mail
2009-04-14 14:24 . 2008-07-31 12:22 ——– d—–w c:\program files\Common Files\Adobe
2009-04-02 16:46 . 2009-04-02 16:46 ——– d—–w c:\program files\DivX
2009-04-02 16:46 . 2009-04-02 16:46 ——– d—–w c:\program files\Common Files\DivX Shared
2009-03-26 19:23 . 2009-03-26 19:23 36864 —-a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-26 19:23 . 2009-03-26 19:23 1900544 —-a-w c:\windows\system32\usbaaplrc.dll
2009-03-23 20:10 . 2008-07-31 20:27 ——– d—–w c:\program files\Windows Live
2009-03-23 20:08 . 2009-03-23 20:08 ——– d—–w c:\program files\Microsoft SQL Server Compact Edition
2009-03-23 20:08 . 2009-03-23 20:07 ——– d—–w c:\program files\Microsoft
2009-03-23 20:06 . 2009-03-23 20:06 ——– d—–w c:\program files\Windows Live SkyDrive
2009-03-23 19:58 . 2009-03-23 19:58 ——– d—–w c:\program files\Common Files\Windows Live
2009-03-19 20:32 . 2009-04-20 12:32 23400 —-a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-17 17:26 . 2009-03-17 17:26 65320 —-a-w c:\windows\system32\sbbd.exe
2009-03-17 03:38 . 2009-04-16 22:16 13824 —-a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 22:16 24064 —-a-w c:\windows\system32\amxread.dll
2009-03-05 03:30 . 2009-03-05 03:30 69936 —-a-w c:\windows\system32\drivers\sbapifs.sys
2009-03-03 04:46 . 2009-04-16 22:16 3599328 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 22:16 3547632 —-a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-16 22:15 827392 —-a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-16 22:16 183296 —-a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 22:16 551424 —-a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 22:16 26112 —-a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 22:15 78336 —-a-w c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-16 22:16 98304 —-a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 22:16 54784 —-a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-16 22:16 44032 —-a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-16 22:16 666624 —-a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 22:16 17408 —-a-w c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-16 22:15 26624 —-a-w c:\windows\system32\ieUnatt.exe
2009-02-24 19:34 . 2009-02-24 19:34 90112 —-a-w c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34 815104 —-a-w c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34 802816 —-a-w c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34 684032 —-a-w c:\windows\system32\DivX.dll
2008-01-21 02:43 . 2006-11-02 12:50 174 –sha-w c:\program files\desktop.ini
2008-08-25 14:25 . 2008-08-25 14:25 22 –sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-01-09 20:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-01-09 20:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-01-09 20:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"GoToMeeting"="c:\program files\Citrix\GoToMeeting\320\g2mstart.exe" [2008-10-07 31552]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-25 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-25 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-25 133656]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2009-03-17 955688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-01-09 669840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-11-16 44168]

c:\users\od\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
autobahn.lnk - c:\programdata\Autobahn\autobahn.exe [2009-1-21 712408]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
VPN Client.lnk - c:\windows\Installer\{871DF2BE-41D2-4334-AC33-839AF16FC8FE}\Icon3E5562ED7.ico [2009-2-26 6144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ADF403AE-14A0-454B-8D08-F241D4DD0239}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{3ADC0D61-0236-4732-9C98-BC859CCD336F}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{16AB5610-7CEE-4D33-B3AA-4DEF4CC1ABCD}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{43DD6BF7-7628-47FD-89C5-03996974329B}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0B1D2605-F23B-4B15-AD92-72A6A8E43CCB}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{00E98F33-552B-497D-9152-1E4AA7E3D66D}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{190EFC28-BBAB-42B7-B1A7-6C9F98CF122C}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{ADABB32B-95E2-4DF1-B9F4-CDEA6EFA2758}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{8C2CCB92-A1EE-4AE8-9624-177C88F5A255}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{06B18A73-A5A1-499F-A3C3-7B93A64A8EE8}"= UDP:3703:Adobe Version Cue CS3 Server
"{BA9874D8-F81C-44DD-AEF8-9C0C53BF4E7A}"= UDP:3704:Adobe Version Cue CS3 Server
"{10C50BC2-6389-46ED-8350-C03806581C92}"= UDP:50900:Adobe Version Cue CS3 Server
"{202B61A9-438E-453B-A5DB-008632DC4D71}"= UDP:50901:Adobe Version Cue CS3 Server
"{3A0856B2-F4C8-40DE-B2FE-24C452CC7532}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server
"{B1A71706-4C3E-4325-933C-2864E9246EC5}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server
"TCP Query User{6C0F5BD0-C939-4AD1-88B3-D550328E932E}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= UDP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"UDP Query User{3C41D508-231F-48C8-9021-7F9CED2A19E5}c:\\program files\\adobe\\adobe dreamweaver cs3\\dreamweaver.exe"= TCP:c:\program files\adobe\adobe dreamweaver cs3\dreamweaver.exe:Adobe Dreamweaver CS3
"TCP Query User{E479FC21-ED52-4D9D-A3D4-08497808C4CA}c:\\program files\\mionet\\jvm\\bin\\mionet.exe"= UDP:c:\program files\mionet\jvm\bin\mionet.exe:Java™ Platform SE binary
"UDP Query User{0E78D926-360E-4908-81F3-261C7BC0F2BA}c:\\program files\\mionet\\jvm\\bin\\mionet.exe"= TCP:c:\program files\mionet\jvm\bin\mionet.exe:Java™ Platform SE binary
"{8E374D52-52C2-42F7-BF94-598024749DDD}"= UDP:1700:MioNet Remote Drive Access 0
"{D14DC828-086A-4F7F-A870-6CA0B028095E}"= UDP:1701:MioNet Remote Drive Access 1
"{C4F5A6BB-0046-4EE0-AA84-8A69BDC0946E}"= UDP:1702:MioNet Remote Drive Access 2
"{32F027AE-EAC5-42AB-9030-86C807395479}"= UDP:1703:MioNet Remote Drive Access 3
"{72B874EB-E144-4EC9-84EB-3798B2E202DE}"= UDP:1704:MioNet Remote Drive Access 4
"{39C9314D-F9DD-4D30-B5BA-652BA1EE206A}"= UDP:1705:MioNet Remote Drive Access 5
"{7A42EC76-FD60-4CA7-A4E3-E2188A6154E2}"= UDP:1706:MioNet Remote Drive Access 6
"{2B610D8B-F9CB-4FDC-9B83-B5924BD01671}"= UDP:1707:MioNet Remote Drive Access 7
"{263C49D0-AF0D-47E5-AA86-E777C69FDE6B}"= UDP:1708:MioNet Remote Drive Access 8
"{602011DC-CD0B-4458-B26D-54127C9C30E8}"= UDP:1709:MioNet Remote Drive Access 9
"{D642685D-F00B-4685-A687-650AAC61082E}"= UDP:1641:MioNet Remote Drive Verification
"{17983D87-337E-4D2A-BAF4-36C486C0148C}"= UDP:1647:MioNet Storage Device Configuration
"{E98D9B7A-680C-4B30-A2C6-03A92A10D81B}"= TCP:5432:MioNet Storage Device Discovery
"{A45F02C0-38FA-4C13-87C7-EB9FD9C75AF9}"= UDP:c:\program files\MioNet\MioNetManager.exe:MioNetManager
"{E7FB4F59-8E44-492B-A7C7-FCCE1062C6F3}"= TCP:c:\program files\MioNet\MioNetManager.exe:MioNetManager
"{B6E21AC5-B699-4283-8377-A178F90EBAC1}"= UDP:c:\program files\MioNet\MioNetManager.exe:MioNetManager
"{B168714D-7FF1-457A-A6ED-459DF1653DA3}"= TCP:c:\program files\MioNet\MioNetManager.exe:MioNetManager
"{2313CB53-997A-4B8A-AFC2-E8A6A580E93D}"= UDP:c:\program files\MioNet\jvm\bin\MioNet.exe:MioNet
"{52AD294D-E7B6-4F3B-ABB4-7FAAE753CDA8}"= TCP:c:\program files\MioNet\jvm\bin\MioNet.exe:MioNet
"TCP Query User{E53DCED6-539F-41E8-9650-388CC5F29DE6}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{B5D3121B-8792-460F-9512-330A278F4B25}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{18935517-D411-49AE-B636-5148177FC984}c:\\program files\\3com\\tftp server\\jre\\bin\\javaw.exe"= UDP:c:\program files\3com\tftp server\jre\bin\javaw.exe:Java™ 2 Platform Standard Edition binary
"UDP Query User{A3ECBA7E-B7DE-4C81-9FBB-76146616DCE8}c:\\program files\\3com\\tftp server\\jre\\bin\\javaw.exe"= TCP:c:\program files\3com\tftp server\jre\bin\javaw.exe:Java™ 2 Platform Standard Edition binary
"TCP Query User{EB1FBEFC-3A42-432B-8A08-4C60308EE767}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{14138AD8-D305-4219-83B4-E3F80F911E48}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{8A36931A-1249-4F25-B235-F5A737057CAC}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{712CF215-00A4-4799-857E-6C076CEAC0F7}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{F0B0D1CE-ED25-41C5-B337-2BCE9B22C27C}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{6CE8A071-2563-48FB-B18A-6762E178DC00}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{1C31C29E-C923-44A4-9217-5CC1403F3A8D}c:\\program files\\crossloop\\crossloopconnect.exe"= UDP:c:\program files\crossloop\crossloopconnect.exe:CrossLoop - Simple Secure Screen Sharing
"UDP Query User{540AC2C7-0287-4F5C-8816-BE321E0EB9EF}c:\\program files\\crossloop\\crossloopconnect.exe"= TCP:c:\program files\crossloop\crossloopconnect.exe:CrossLoop - Simple Secure Screen Sharing
"TCP Query User{E159E307-19B1-4090-9F3F-AE0E6122D900}c:\\users\\od\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= UDP:c:\users\od\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"UDP Query User{312881B2-E83A-43B0-9327-76A09EE4D332}c:\\users\\od\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= TCP:c:\users\od\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"TCP Query User{7A5CAD7D-91B2-4FFB-BEBF-24F2239C76CC}c:\\program files\\quicktime\\quicktimeplayer.exe"= UDP:c:\program files\quicktime\quicktimeplayer.exe:QuickTime Player
"UDP Query User{C5189341-957D-4574-9CF5-CF3DD21FB9B2}c:\\program files\\quicktime\\quicktimeplayer.exe"= TCP:c:\program files\quicktime\quicktimeplayer.exe:QuickTime Player
"TCP Query User{F430C13D-3E2B-4E23-96D3-F6FAFD6A47D0}c:\\programdata\\autobahn\\autobahn.exe"= UDP:c:\programdata\autobahn\autobahn.exe:autobahn
"UDP Query User{A4E97CC4-B9FC-4C1F-B7DE-FAD467D9EA86}c:\\programdata\\autobahn\\autobahn.exe"= TCP:c:\programdata\autobahn\autobahn.exe:autobahn
"{0EF0E412-327C-489F-B7B5-FF03AE59E3D4}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{6C186629-22EC-4BAB-87CA-7D425541EF9A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B204C7D6-6207-4BEE-8957-BA1DC0F7BF86}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{7E17001B-F687-452D-B3C4-E955430E4A0C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{90762EA5-10EE-4784-BD79-249CC7507BCF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R1 sbtis;sbtis;c:\windows\System32\drivers\sbtis.sys [10/8/2008 4:39 PM 202160]
R2 sbapifs;sbapifs;c:\windows\System32\drivers\sbapifs.sys [3/4/2009 11:30 PM 69936]
S2 SBAMSvc;VIPRE Antivirus + Antispyware;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [3/17/2009 1:26 PM 894248]
S3 SBRE;SBRE;c:\windows\System32\drivers\SBREDrv.sys [10/22/2008 5:08 PM 92464]
.
Contents of the 'Scheduled Tasks' folder

2009-05-20 c:\windows\Tasks\User_Feed_Synchronization-{4988A962-F645-4178-9F04-CABB5F8B5883}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://online.americanbus.com/psp/fin89prd…;languageCd=ENG
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=81&bd;=Pavilion&pf;=desktop
uInternet Settings,ProxyOverride = *.local
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
Trusted Zone: hotmail.com\messenger
Trusted Zone: passport.com\loginnet
Trusted Zone: yahoo.com\www
FF - ProfilePath - c:\users\od\AppData\Roaming\Mozilla\Firefox\Profiles\k4dfnfyg.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\users\od\AppData\Roaming\Mozilla\Firefox\Profiles\k4dfnfyg.default\extensions\[removed]\components\coolirisstub.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 12:27
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\users\od\AppData\Local\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-05-20 12:28
ComboFix-quarantined-files.txt 2009-05-20 16:28

Pre-Run: 451,679,469,568 bytes free
Post-Run: 451,652,661,248 bytes free

257 — E O F — 2009-04-29 07:00
Post #6
Hi,

Please do the following:

Try running the malwareBytes program once more, see if it will run now.

NEXT


Please do an online scan with Kaspersky WebScanner

Click on Accept

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

NEXT

Open HJT click on Do a system scan and save a logfile button
once the scan has completed a notepad should open - copy/paste that log here.

In your next reply please include
  • MBAM log
  • Kaspersky report
  • The fresh HJT log
Post #7
Cat, just fyi… my google search results are no longer redirecting it would seem. Also, it would appear that VIPRE just quarantined a trojan and it is now successfully loading new virus definitions. I'm not saying the problem is fixed, but I thought this might be important info. I will proceed with the actions your requested in the last post and I will post the log files shortly.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI