Spyware / Malware / Virus Removal

[Resolved] Internet browsing issues

11 min read

Looking for the outcome? Ask AI

Sarina Topic Starter

Post #1August 29, 2009, 11:13 PM UTC last edited August 29, 2009, 11:17 PM UTC

I am having issues with my Internet Browsing when I do a search and click on a link it will take several times before it actually takes me to the correct website. I have tried running Malwarebytes in safe mode it runs fine but in normal mode it freezes up. I have also run superantispyware it finds something called Rootkit.Agent/Gen-Rustock[KBI] I try to remove it but when I run the program again it is back. I have run hijackthis and am including a copy of my log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:06 PM, on 8/29/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\TOSHIBA Service Station\TSS.exe
C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe
C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files\TOSHIBA\TOSHIBA Service Station\TSS.exe" /hide
O4 - HKLM\..\Run: [PCMAgent] "C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 13901 bytes

Raktor

Post #2August 30, 2009, 7:03 AM UTC

[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to take a look at your log.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay, but I will do my best to keep it as short as possible.

Please follow the instructions in our Welcome New Members topic, and post the DDS and RootRepeal logs in this topic. We'll continue from there.

Sarina

Post #3August 30, 2009, 12:40 PM UTC

The following are the reports you asked for ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/30 08:27 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP1 ================================================== Drivers ——————- Name: dump_iaStor.sys Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys Address: 0x8DA0A000 Size: 888832 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0x8A1ED000 Size: 49152 File Visible: No Signed: - Status: - Processes ——————- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1416 Status: Locked to the Windows API! Hidden Services ——————- Service Name: kbiwkmiqdgbteo Image Path: C:\Windows\system32\drivers\kbiwkmvqcneqyi.sys Service Name: kbiwkmrvpmroce Image Path: C:\Windows\system32\drivers\kbiwkmkgvsmwip.sys ==EOF== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 8:05:18.38 on Sun 08/30/2009 Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1832 [GMT -4:00] SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe C:\Windows\system32\TODDSrv.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Toshiba\SmoothView\SmoothView.exe C:\Program Files\Toshiba\FlashCards\TCrdMain.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\ConfigFree\NDSTray.exe C:\Program Files\Toshiba\TOSHIBA Service Station\TSS.exe C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Sarina\Downloads\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearch Page = uStart Page = hxxp://www.yahoo.com uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB uSearch Bar = mStart Page = hxxp://www.yahoo.com/ mDefault_Page_URL = hxxp://www.yahoo.com/ mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com mSearchAssistant = uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll uRun: [TOSCDSPD] TOSCDSPD.EXE uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe" uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [NDSTray.exe] NDSTray.exe mRun: [cfFncEnabler.exe] cfFncEnabler.exe mRun: [ToshibaServiceStation] "c:\program files\toshiba\toshiba service station\TSS.exe" /hide mRun: [PCMAgent] "c:\program files\cyberlink\powercinema for toshiba\PCMAgent.exe" mRun: [CLMLServer] "c:\program files\cyberlink\powercinema for toshiba\kernel\clml\CLMLSvc.exe" mRun: [WinampAgent] "c:\program files\winamp\winampa.exe" mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe" mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\users\sarina\appdata\roaming\micros~1\windows\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe StartupFolder: c:\users\sarina\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: igfxcui - igfxdev.dll AppInit_DLLs: avgrsstx.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\users\sarina\appdata\roaming\mozilla\firefox\profiles\auzck6vf.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p= FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\nptgeqplugin.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: google.toolbar.linkdoctor.enabled - false c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-28 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-28 108552] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-8-5 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-8-5 74480] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-28 297752] R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-7-10 40960] R2 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2008-8-14 46392] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976] R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\common files\microsoft shared\windows live\WLIDSVC.EXE [2009-3-30 1533808] R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392] R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-14 7168] R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-4-28 3658752] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-8-5 7408] R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-6-15 55280] S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?] S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-20 9216] =============== Created Last 30 ================ 2009-08-29 19:30 243,165,131 a——- c:\windows\MEMORY.DMP 2009-08-29 17:49 –d—– c:\program files\Trend Micro 2009-08-29 15:18 –d—– c:\users\sarina\appdata\roaming\Malwarebytes 2009-08-29 15:18 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-29 15:18 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-29 15:18 –d—– c:\programdata\Malwarebytes 2009-08-29 15:18 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-08-29 15:18 –d—– c:\progra~2\Malwarebytes 2009-08-28 20:05 –d-h— C:\$AVG8.VAULT$ 2009-08-28 19:31 –d—– c:\programdata\SUPERAntiSpyware.com 2009-08-28 19:31 –d—– c:\progra~2\SUPERAntiSpyware.com 2009-08-28 19:31 –d—– c:\program files\SUPERAntiSpyware 2009-08-28 19:30 –d—– c:\users\sarina\appdata\roaming\SUPERAntiSpyware.com 2009-08-28 19:27 –d—– c:\program files\common files\Wise Installation Wizard 2009-08-28 18:22 108,552 a——- c:\windows\system32\drivers\avgtdix.sys 2009-08-28 18:22 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-08-28 18:22 335,240 a——- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 18:21 –d—– c:\windows\system32\drivers\Avg 2009-08-28 18:21 –d—– c:\programdata\AVG Security Toolbar 2009-08-28 18:21 –d—– c:\progra~2\AVG Security Toolbar 2009-08-28 18:21 –d—– c:\program files\AVG 2009-08-28 18:21 –d—– c:\programdata\avg8 2009-08-28 18:21 –d—– c:\progra~2\avg8 2009-08-28 18:17 –d—– c:\users\sarina\appdata\roaming\AVG8 2009-08-28 16:12 58,341 a——- c:\windows\system32\u_vhumolecpcrdl.dll.exe 2009-08-28 16:05 219 a——- c:\windows\system32\winset.ini 2009-08-28 16:05 –d—– c:\program files\IEToolbar 2009-08-28 16:05 889,078 a——- c:\windows\rdnbd2350.exe 2009-08-27 14:33 2,805,084 a——- c:\windows\system32\GameMon.des 2009-08-27 14:32 5,174 a——- c:\windows\system32\nppt9x.vxd 2009-08-27 14:32 4,682 a——- c:\windows\system32\npptNT2.sys 2009-08-27 14:32 –d—– c:\program files\common files\INCA Shared 2009-08-27 14:26 –d—– C:\Ntreev USA 2009-08-26 23:31 2,048 a——- c:\windows\system32\tzres.dll 2009-08-26 22:03 256 a——- c:\windows\system32\pool.bin 2009-08-26 21:58 –d—– c:\users\sarina\appdata\roaming\Research In Motion 2009-08-26 21:51 –d—– c:\programdata\InstallShield 2009-08-26 21:51 –d—– c:\programdata\Sonic 2009-08-26 21:49 –d—– c:\program files\common files\Sonic Shared 2009-08-26 21:49 –d—– c:\programdata\Roxio 2009-08-26 21:49 –d—– c:\program files\Roxio 2009-08-26 21:45 26,496 a——- c:\windows\system32\drivers\RimSerial.sys 2009-08-26 21:44 –d—– c:\program files\common files\Research In Motion 2009-08-26 21:44 –d—– c:\program files\Research In Motion 2009-08-26 06:51 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-26 06:51 28,672 a——- c:\windows\system32\Apphlpdm.dll 2009-08-13 00:08 –d—– c:\programdata\Yahoo! Companion 2009-08-12 22:24 71,680 a——- c:\windows\system32\atl.dll 2009-08-12 22:24 160,256 a——- c:\windows\system32\wkssvc.dll 2009-08-12 22:24 313,344 a——- c:\windows\system32\wmpdxm.dll 2009-08-12 22:24 7,680 a——- c:\windows\system32\spwmp.dll 2009-08-12 22:24 8,147,456 a——- c:\windows\system32\wmploc.DLL 2009-08-12 22:24 43,520 a——- c:\windows\system32\msdxm.tlb 2009-08-12 22:24 18,432 a——- c:\windows\system32\amcompat.tlb 2009-08-12 22:24 4,096 a——- c:\windows\system32\msdxm.ocx 2009-08-12 22:24 4,096 a——- c:\windows\system32\dxmasf.dll 2009-08-12 22:24 91,136 a——- c:\windows\system32\avifil32.dll 2009-08-12 22:24 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-08-01 00:44 0 a—h— c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf ==================== Find3M ==================== 2009-08-28 18:03 143,360 a——- c:\windows\inf\infstrng.dat 2009-08-28 18:03 86,016 a——- c:\windows\inf\infstor.dat 2009-08-28 18:03 51,200 a——- c:\windows\inf\infpub.dat 2009-07-25 05:23 411,368 a——- c:\windows\system32\deploytk.dll 2009-07-21 17:52 915,456 a——- c:\windows\system32\wininet.dll 2009-07-21 17:47 109,056 a——- c:\windows\system32\iesysprep.dll 2009-07-21 17:47 71,680 a——- c:\windows\system32\iesetup.dll 2009-07-21 16:13 133,632 a——- c:\windows\system32\ieUnatt.exe 2009-06-15 11:24 156,672 a——- c:\windows\system32\t2embed.dll 2009-06-15 11:20 72,704 a——- c:\windows\system32\fontsub.dll 2009-06-15 11:20 10,240 a——- c:\windows\system32\dciman32.dll 2009-06-15 08:52 289,792 a——- c:\windows\system32\atmfd.dll 2009-06-05 11:42 2,060,288 a——- c:\windows\system32\usbaaplrc.dll 2009-06-05 08:34 173,056 a——- c:\windows\apppatch\AcXtrnal.dll 2009-06-05 08:33 459,776 a——- c:\windows\apppatch\AcSpecfc.dll 2009-06-05 08:33 541,696 a——- c:\windows\apppatch\AcLayers.dll 2009-06-05 08:33 2,153,984 a——- c:\windows\apppatch\AcGenral.dll 2008-08-14 15:49 665,600 a——- c:\windows\inf\drvindex.dat 2008-01-20 22:43 174 a–sh— c:\program files\desktop.ini 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat ============= FINISH: 8:06:33.65 ===============

Attachments:

📎Attach.txt

Raktor

Post #4August 30, 2009, 1:13 PM UTC

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

Please download Combofix from either of the links below, and save it to your desktop.
You must rename it before saving it. Save it as Combo-Fix.exe.

[external image: Posted Image]

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link:How to Disable your Security Programs
Double click on Combo-Fix.exe & follow the prompts. Close all browsers/windows first.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Sarina

Post #5August 30, 2009, 8:03 PM UTC

Here is the copy of the combo text log ComboFix 09-08-30.01 - Sarina 08/30/2009 15:24.1.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.2113 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1613085345-1796840964-2308868410-500 c:\$recycle.bin\S-1-5-21-737594619-1414829202-3786626943-500 c:\program files\IEToolbar c:\users\Sarina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 7 c:\users\Sarina\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1C02.tmp c:\users\Sarina\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp39DE.tmp c:\windows\Installer\WMEncoder.msi c:\windows\rdnbd2350.exe c:\windows\system32\drivers\kbiwkmbvotsfmc.sys c:\windows\system32\drivers\kbiwkmdtpxsmtx.sys c:\windows\system32\drivers\kbiwkmfacpvtmt.sys c:\windows\system32\drivers\kbiwkmfwblvelm.sys c:\windows\system32\drivers\kbiwkmkgvsmwip.sys c:\windows\system32\drivers\kbiwkmpmyjnbyr.sys c:\windows\system32\drivers\kbiwkmpvbrorpq.sys c:\windows\system32\drivers\kbiwkmrmuetjim.sys c:\windows\system32\drivers\kbiwkmrpltbdux.sys c:\windows\system32\drivers\kbiwkmttmpxnwq.sys c:\windows\system32\drivers\kbiwkmvqcneqyi.sys c:\windows\system32\drivers\kbiwkmwdmopwee.sys c:\windows\system32\kbiwkmcarqbhns.dat c:\windows\system32\kbiwkmcckuisns.dat c:\windows\system32\kbiwkmcvjtxmmt.dat c:\windows\system32\kbiwkmeqnxkenx.dll c:\windows\system32\kbiwkmeynosnuv.dll c:\windows\system32\kbiwkmfxrnbfwp.dll c:\windows\system32\kbiwkmgdbqmcsq.dat c:\windows\system32\kbiwkmibcvknwi.dll c:\windows\system32\kbiwkmibqneipf.dat c:\windows\system32\kbiwkmicfpjkwv.dll c:\windows\system32\kbiwkmkbcifset.dat c:\windows\system32\kbiwkmmjsidvqy.dll c:\windows\system32\kbiwkmmknwmhtu.dat c:\windows\system32\kbiwkmngpucrnt.dll c:\windows\system32\kbiwkmrdxesixx.dll c:\windows\system32\kbiwkmrekluuqt.dll c:\windows\system32\kbiwkmrwyibrmb.dll c:\windows\system32\kbiwkmtwqwsxqu.dll c:\windows\system32\kbiwkmvbfrbpxb.dll c:\windows\system32\kbiwkmvxhchcht.dat c:\windows\system32\kbiwkmwjiqpuft.dll c:\windows\system32\kbiwkmxiwiqbxq.dll c:\windows\system32\kbiwkmxpclqwnk.dll c:\windows\system32\kbiwkmyrpxcftx.dll c:\windows\system32\kbiwkmyvyortdn.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Service_kbiwkmiqdgbteo ——-\Service_kbiwkmrvpmroce ——-\Legacy_kbiwkmiqdgbteo ——-\Legacy_kbiwkmrvpmroce ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 ))))))))))))))))))))))))))))))) . 2009-08-30 19:29 . 2009-08-30 19:33 ——– d—–w- c:\users\Sarina\AppData\Local\temp 2009-08-30 19:29 . 2009-08-30 19:29 ——– d—–w- c:\users\Default\AppData\Local\temp 2009-08-30 12:00 . 2009-08-30 12:00 ——– d—–w- c:\program files\ERUNT 2009-08-29 21:49 . 2009-08-29 21:49 ——– d—–w- c:\program files\Trend Micro 2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\users\Sarina\AppData\Roaming\Malwarebytes 2009-08-29 19:18 . 2009-08-03 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\programdata\Malwarebytes 2009-08-29 19:18 . 2009-08-03 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-08-29 00:05 . 2009-08-30 17:14 ——– d–h–w- C:\$AVG8.VAULT$ 2009-08-28 23:35 . 2009-08-30 11:55 117760 —-a-w- c:\users\Sarina\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-08-28 23:31 . 2009-08-28 23:31 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2009-08-28 23:31 . 2009-08-28 23:31 ——– d—–w- c:\program files\SUPERAntiSpyware 2009-08-28 23:30 . 2009-08-28 23:30 ——– d—–w- c:\users\Sarina\AppData\Roaming\SUPERAntiSpyware.com 2009-08-28 23:27 . 2009-08-28 23:27 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard 2009-08-28 22:23 . 2009-08-28 22:23 ——– d—–w- c:\users\Sarina\AppData\Local\AVG Security Toolbar 2009-08-28 22:22 . 2009-08-28 22:22 11952 —-a-w- c:\windows\system32\avgrsstx.dll 2009-08-28 22:22 . 2009-08-28 22:22 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2009-08-28 22:22 . 2009-08-28 22:22 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2009-08-28 22:21 . 2009-08-28 22:21 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-08-28 22:21 . 2009-08-30 13:40 ——– d—–w- c:\windows\system32\drivers\Avg 2009-08-28 22:21 . 2009-08-28 22:22 ——– d—–w- c:\programdata\AVG Security Toolbar 2009-08-28 22:21 . 2009-08-28 22:21 ——– d—–w- c:\program files\AVG 2009-08-28 22:21 . 2009-08-28 22:21 ——– d—–w- c:\programdata\avg8 2009-08-28 22:17 . 2009-08-28 22:17 ——– d—–w- c:\users\Sarina\AppData\Roaming\AVG8 2009-08-28 20:12 . 2009-08-28 20:12 58341 —-a-w- c:\windows\system32\u_vhumolecpcrdl.dll.exe 2009-08-28 19:19 . 2009-08-28 19:19 175 —-a-w- c:\users\Sarina\AppData\Roaming\Azureus\restart.bat 2009-08-27 18:32 . 2005-01-05 03:43 4682 —-a-w- c:\windows\system32\npptNT2.sys 2009-08-27 18:32 . 2009-08-27 18:32 ——– d—–w- c:\program files\Common Files\INCA Shared 2009-08-27 18:26 . 2009-08-27 18:26 ——– d—–w- C:\Ntreev USA 2009-08-27 03:31 . 2009-06-22 10:22 2048 —-a-w- c:\windows\system32\tzres.dll 2009-08-27 02:03 . 2009-08-27 02:47 256 —-a-w- c:\windows\system32\pool.bin 2009-08-27 02:02 . 2009-08-27 02:02 26694 —-a-r- c:\users\Sarina\AppData\Roaming\Microsoft\Installer\{D5CE7FB6-6FAE-45F6-984C-0081BBCA7A6C}\BlackBerry.exe 2009-08-27 01:58 . 2009-08-27 01:58 ——– d—–w- c:\users\Sarina\AppData\Roaming\Research In Motion 2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\users\Sarina\AppData\Roaming\InstallShield 2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\programdata\InstallShield 2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\programdata\Sonic 2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Common Files\Sonic Shared 2009-08-27 01:49 . 2009-08-27 01:50 ——– d—–w- c:\programdata\Roxio 2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Roxio 2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Common Files\Roxio Shared 2009-08-27 01:45 . 2007-01-18 14:24 26496 —-a-w- c:\windows\system32\drivers\RimSerial.sys 2009-08-27 01:44 . 2009-08-27 02:02 ——– d—–w- c:\program files\Common Files\Research In Motion 2009-08-27 01:44 . 2009-08-27 01:44 ——– d—–w- c:\program files\Research In Motion 2009-08-26 10:51 . 2009-06-05 12:34 28672 —-a-w- c:\windows\system32\Apphlpdm.dll 2009-08-26 10:51 . 2009-06-05 10:08 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-13 04:08 . 2009-08-28 20:05 ——– d—–w- c:\programdata\Yahoo! Companion 2009-08-13 04:08 . 2009-05-26 23:50 607472 —-a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe 2009-08-13 02:24 . 2009-07-17 14:35 71680 —-a-w- c:\windows\system32\atl.dll 2009-08-13 02:24 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll 2009-08-13 02:24 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll 2009-08-13 02:24 . 2009-07-14 12:58 7680 —-a-w- c:\windows\system32\spwmp.dll 2009-08-13 02:24 . 2009-07-14 12:59 4096 —-a-w- c:\windows\system32\dxmasf.dll 2009-08-13 02:24 . 2009-07-14 10:59 8147456 —-a-w- c:\windows\system32\wmploc.DLL 2009-08-13 02:24 . 2009-06-10 12:07 91136 —-a-w- c:\windows\system32\avifil32.dll 2009-08-13 02:24 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-30 12:02 . 2009-06-20 17:27 ——– d—–w- c:\users\Sarina\AppData\Roaming\LimeWire 2009-08-29 18:26 . 2008-08-14 19:23 ——– d—–w- c:\program files\Java 2009-08-28 22:05 . 2008-08-15 01:00 ——– d—–w- c:\program files\Common Files\Symantec Shared 2009-08-28 22:03 . 2008-08-15 01:00 ——– d—–w- c:\programdata\Symantec 2009-08-28 20:12 . 2009-06-15 19:42 ——– d—–w- c:\users\Sarina\AppData\Roaming\Azureus 2009-08-28 19:17 . 2009-06-15 19:41 ——– d—–w- c:\program files\Vuze 2009-08-27 01:57 . 2009-06-15 05:04 127856 —-a-w- c:\users\Sarina\AppData\Local\GDIPFONTCACHEV1.DAT 2009-08-27 01:49 . 2009-06-15 18:39 ——– d—–w- c:\program files\Common Files\PX Storage Engine 2009-08-27 01:49 . 2008-08-14 19:01 ——– d—–w- c:\program files\Common Files\InstallShield 2009-08-26 14:43 . 2009-06-15 18:39 ——– d—–w- c:\users\Sarina\AppData\Roaming\Winamp 2009-08-13 05:05 . 2009-01-18 06:47 ——– d—–w- c:\programdata\Microsoft Help 2009-08-13 05:05 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail 2009-08-13 04:09 . 2009-06-15 17:58 ——– d—–w- c:\users\Sarina\AppData\Roaming\Yahoo! 2009-08-13 04:09 . 2009-06-15 17:58 ——– d—–w- c:\program files\Yahoo! 2009-08-13 04:08 . 2009-06-15 17:58 ——– d—–w- c:\programdata\Yahoo! 2009-08-10 03:01 . 2009-06-23 01:31 ——– d—–w- c:\users\Sarina\AppData\Roaming\gtk-2.0 2009-08-04 03:58 . 2009-06-15 18:39 ——– d—–w- c:\program files\Winamp 2009-08-01 04:47 . 2009-06-15 23:29 ——– d—–w- c:\program files\Microsoft Silverlight 2009-08-01 04:44 . 2009-08-01 04:44 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf 2009-07-27 21:26 . 2009-06-15 18:16 ——– d—–w- c:\users\Sarina\AppData\Roaming\SecondLife 2009-07-25 17:56 . 2008-08-14 19:19 ——– d—–w- c:\programdata\CyberLink 2009-07-25 16:10 . 2009-07-25 16:10 746760 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2009-07-25 09:23 . 2009-06-28 01:10 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-07-21 21:52 . 2009-08-01 04:43 915456 —-a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-08-01 04:43 109056 —-a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-08-01 04:43 71680 —-a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-08-01 04:43 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2009-07-20 22:45 . 2009-07-20 22:45 ——– d—–w- c:\program files\iTunes 2009-07-20 22:45 . 2009-07-20 22:45 ——– d—–w- c:\program files\iPod 2009-07-20 22:45 . 2009-06-18 19:41 ——– d—–w- c:\program files\Common Files\Apple 2009-07-20 22:42 . 2009-07-20 22:42 75040 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe 2009-07-20 22:06 . 2009-06-15 21:31 ——– d—–w- c:\programdata\FLEXnet 2009-06-16 13:42 . 2009-06-16 13:41 14479040 —-a-w- c:\programdata\WildTangent\TOSHIBA Game Console\Downloads\en-us\Installers\SetupGamesClient.exe 2009-06-16 11:58 . 2009-06-16 11:58 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll 2009-06-16 11:58 . 2009-06-16 11:58 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll 2009-06-15 20:02 . 2009-06-15 20:02 86016 —-a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe 2009-06-15 15:24 . 2009-07-15 15:35 156672 —-a-w- c:\windows\system32\t2embed.dll 2009-06-15 15:20 . 2009-07-15 15:35 72704 —-a-w- c:\windows\system32\fontsub.dll 2009-06-15 15:20 . 2009-07-15 15:35 10240 —-a-w- c:\windows\system32\dciman32.dll 2009-06-15 12:52 . 2009-07-15 15:35 289792 —-a-w- c:\windows\system32\atmfd.dll 2009-06-15 05:03 . 2009-06-15 05:03 13 –sh–r- c:\windows\system32\drivers\fbd.sys 2009-06-15 05:03 . 2009-06-15 05:03 4 –sh–r- c:\windows\system32\drivers\taishop.sys 2009-06-05 15:42 . 2009-06-05 15:42 39424 —-a-w- c:\windows\system32\drivers\usbaapl.sys 2009-06-05 15:42 . 2009-06-05 15:42 2060288 —-a-w- c:\windows\system32\usbaaplrc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-07-24 13:55 1090816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944] "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-07-31 417792] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 431456] "HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-11-01 54608] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-06-16 448080] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904] "ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\TSS.exe" [2008-08-04 1242424] "PCMAgent"="c:\program files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360] "CLMLServer"="c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856] "BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-28 2007832] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-04-08 6037504] "NDSTray.exe"="NDSTray.exe" [BU] c:\users\Sarina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-5-22 139776] OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{37E430F4-5480-440F-B2D7-D711B3DDB7C7}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\PowerCinema.exe:CyberLink PowerCinema "{AE87CBDF-C7A6-4D36-89B5-E9764299ED33}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\PCMService.exe:CyberLink PowerCinema Resident Program "{09B4A36F-378B-4103-8749-232DA98F40B4}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine "{19B80962-D2B7-4047-A5D1-352865D490EF}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\DMS\CLMSService.exe:CyberLink Media Server "{E908A6B6-BCA2-4F8D-AC2B-1160405AF868}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{04F279D6-91BB-450B-BC97-32B7AEA59D33}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "TCP Query User{5D4D92D6-3789-4AE6-979E-0816486466B2}c:\\program files\\secondlife\\slvoice.exe"= UDP:c:\program files\secondlife\slvoice.exe:SLVoice "UDP Query User{0DDE2AC6-C1FC-4AFC-A313-8A6AE04FA347}c:\\program files\\secondlife\\slvoice.exe"= TCP:c:\program files\secondlife\slvoice.exe:SLVoice "{22BF6ED7-26FD-45C5-ACB8-0A7E6CB9A65E}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{1EB8BC87-AE9F-4C61-AD13-E4CCE057BDF7}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{DC41B99C-E470-47F9-8DE0-71BE9C4EA69F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{8F82FA6F-6CE5-4B44-81E2-ED8D12378BD3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{97DEC7D4-815A-4E50-9CCB-B78C53F1ADCA}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{D5AC89BA-8157-4666-9019-549F8A16ECAA}"= UDP:5353:Adobe CSI CS4 "{1130C0ED-AF58-49D9-BE07-5339227A3478}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4 "{C8C3851C-720C-41D3-8C7B-D2AEE687BE91}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4 "{6F3F84AE-F792-4C72-8F79-08914ADB68E7}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{ECC5E097-4CCA-45E0-A456-DD6C385CEFF0}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{85156AAE-9C73-4CB1-9CFF-7C2F450C5B01}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{9C01F557-C3DC-4AF0-B9EE-69CEAA2A6E99}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{25763E55-BB52-43D8-A044-796252B25BFA}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{6BF94468-B003-4E24-AD70-FD7C29EC7627}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{9F9B241F-AF17-447D-8900-6CF601045046}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{409E9E76-EB2C-418E-A69D-BAFD07258428}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{303764CE-4948-4028-8517-3BF34AE0E28D}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [8/28/2009 6:22 PM 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [8/28/2009 6:22 PM 108552] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/28/2009 6:21 PM 297752] R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [7/10/2008 8:58 PM 40960] R2 TMachInfo;TMachInfo;c:\program files\Toshiba\TOSHIBA Service Station\TMachInfo.exe [8/14/2008 3:15 PM 46392] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [12/3/2007 9:03 PM 126976] R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808] R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [8/14/2008 3:08 PM 7168] R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\System32\drivers\NETw5v32.sys [4/28/2008 10:29 AM 3658752] R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [4/24/2008 10:35 PM 73728] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [6/15/2009 7:28 PM 55280] S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 6:08 PM 533360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408] S3 SVRPEDRV;SVRPEDRV;c:\windows\System32\sysprep\PEDRV.SYS [8/20/2008 2:41 PM 9216] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . - - - - ORPHANS REMOVED - - - - HKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe HKCU-Run-TOSCDSPD - TOSCDSPD.EXE HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe . ——- Supplementary Scan ——- . uStart Page = hxxp://www.yahoo.com mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab FF - ProfilePath - c:\users\Sheri\AppData\Roaming\Mozilla\Firefox\Profiles\auzck6vf.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: google.toolbar.linkdoctor.enabled - false c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(3888) c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll . ———————— Other Running Processes ———————— . c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe c:\windows\System32\audiodg.exe c:\windows\System32\wlanext.exe c:\windows\System32\agrsmsvc.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Intel\WiFi\bin\EvtEng.exe c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\progra~1\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe c:\windows\System32\TODDSrv.exe c:\program files\Toshiba\Power Saver\TosCoSrv.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE c:\windows\System32\wbem\WMIADAP.exe . ************************************************************************** . Completion time: 2009-08-30 15:39 - machine was rebooted ComboFix-quarantined-files.txt 2009-08-30 19:38 Pre-Run: 265,748,049,920 bytes free Post-Run: 265,644,048,384 bytes free 405 — E O F — 2009-08-27 03:32

Raktor

Post #6August 31, 2009, 2:11 AM UTC

Please delete the current copy of Combofix that you have (in your Downloads folder), and download it again from here or here, making sure that you save it to your Desktop this time. To do this, generally right click on the link and click 'Save Target As…' or 'Save Link As…' and then select your desktop.

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
http://forums.whatthetech.com/Internet_browsing_issues_t106562.html

Collect::
c:\windows\system32\u_vhumolecpcrdl.dll.exe
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Sarina

Post #7August 31, 2009, 3:04 AM UTC

Here is the log

ComboFix 09-08-30.01 - Sarina 08/30/2009 22:24.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1813 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Sarina\Desktop\CFScript.txt
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

file zipped: c:\windows\system32\u_vhumolecpcrdl.dll.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\u_vhumolecpcrdl.dll.exe

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 02:29 . 2009-08-31 02:29 ——– d—–w- c:\users\Sarina\AppData\Local\temp
2009-08-31 02:29 . 2009-08-31 02:29 ——– d—–w- c:\users\Public\AppData\Local\temp
2009-08-31 02:29 . 2009-08-31 02:29 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-08-31 02:17 . 2009-07-24 13:55 1090816 —-a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll
2009-08-30 12:00 . 2009-08-30 12:00 ——– d—–w- c:\program files\ERUNT
2009-08-29 21:49 . 2009-08-29 21:49 ——– d—–w- c:\program files\Trend Micro
2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\users\Sarina\AppData\Roaming\Malwarebytes
2009-08-29 19:18 . 2009-08-03 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 19:18 . 2009-08-29 19:18 ——– d—–w- c:\programdata\Malwarebytes
2009-08-29 19:18 . 2009-08-03 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 00:05 . 2009-08-30 17:14 ——– d–h–w- C:\$AVG8.VAULT$
2009-08-28 23:35 . 2009-08-30 19:54 117760 —-a-w- c:\users\Sarina\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-28 23:31 . 2009-08-28 23:31 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2009-08-28 23:31 . 2009-08-28 23:31 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-08-28 23:30 . 2009-08-28 23:30 ——– d—–w- c:\users\Sarina\AppData\Roaming\SUPERAntiSpyware.com
2009-08-28 23:27 . 2009-08-28 23:27 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-08-28 22:23 . 2009-08-28 22:23 ——– d—–w- c:\users\Sarina\AppData\Local\AVG Security Toolbar
2009-08-28 22:22 . 2009-08-28 22:22 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-28 22:22 . 2009-08-28 22:22 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-28 22:22 . 2009-08-28 22:22 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-28 22:21 . 2009-08-28 22:21 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-28 22:21 . 2009-08-30 22:18 ——– d—–w- c:\windows\system32\drivers\Avg
2009-08-28 22:21 . 2009-08-31 02:17 ——– d—–w- c:\programdata\AVG Security Toolbar
2009-08-28 22:21 . 2009-08-28 22:21 ——– d—–w- c:\program files\AVG
2009-08-28 22:21 . 2009-08-28 22:21 ——– d—–w- c:\programdata\avg8
2009-08-28 22:17 . 2009-08-28 22:17 ——– d—–w- c:\users\Sarina\AppData\Roaming\AVG8
2009-08-28 19:19 . 2009-08-28 19:19 175 —-a-w- c:\users\Sarina\AppData\Roaming\Azureus\restart.bat
2009-08-27 18:32 . 2005-01-05 03:43 4682 —-a-w- c:\windows\system32\npptNT2.sys
2009-08-27 18:32 . 2009-08-27 18:32 ——– d—–w- c:\program files\Common Files\INCA Shared
2009-08-27 18:26 . 2009-08-27 18:26 ——– d—–w- C:\Ntreev USA
2009-08-27 03:31 . 2009-06-22 10:22 2048 —-a-w- c:\windows\system32\tzres.dll
2009-08-27 02:03 . 2009-08-27 02:47 256 —-a-w- c:\windows\system32\pool.bin
2009-08-27 02:02 . 2009-08-27 02:02 26694 —-a-r- c:\users\Sarina\AppData\Roaming\Microsoft\Installer\{D5CE7FB6-6FAE-45F6-984C-0081BBCA7A6C}\BlackBerry.exe
2009-08-27 01:58 . 2009-08-27 01:58 ——– d—–w- c:\users\Sarina\AppData\Roaming\Research In Motion
2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\users\Sarina\AppData\Roaming\InstallShield
2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\programdata\InstallShield
2009-08-27 01:51 . 2009-08-27 01:51 ——– d—–w- c:\programdata\Sonic
2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-08-27 01:49 . 2009-08-27 01:50 ——– d—–w- c:\programdata\Roxio
2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Roxio
2009-08-27 01:49 . 2009-08-27 01:49 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-08-27 01:45 . 2007-01-18 14:24 26496 —-a-w- c:\windows\system32\drivers\RimSerial.sys
2009-08-27 01:44 . 2009-08-27 02:02 ——– d—–w- c:\program files\Common Files\Research In Motion
2009-08-27 01:44 . 2009-08-27 01:44 ——– d—–w- c:\program files\Research In Motion
2009-08-26 10:51 . 2009-06-05 12:34 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2009-08-26 10:51 . 2009-06-05 10:08 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-13 04:08 . 2009-08-28 20:05 ——– d—–w- c:\programdata\Yahoo! Companion
2009-08-13 04:08 . 2009-05-26 23:50 607472 —-a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe
2009-08-13 02:24 . 2009-07-17 14:35 71680 —-a-w- c:\windows\system32\atl.dll
2009-08-13 02:24 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2009-08-13 02:24 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2009-08-13 02:24 . 2009-07-14 12:58 7680 —-a-w- c:\windows\system32\spwmp.dll
2009-08-13 02:24 . 2009-07-14 12:59 4096 —-a-w- c:\windows\system32\dxmasf.dll
2009-08-13 02:24 . 2009-07-14 10:59 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2009-08-13 02:24 . 2009-06-10 12:07 91136 —-a-w- c:\windows\system32\avifil32.dll
2009-08-13 02:24 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 20:05 . 2009-06-20 17:27 ——– d—–w- c:\users\Sarina\AppData\Roaming\LimeWire
2009-08-29 18:26 . 2008-08-14 19:23 ——– d—–w- c:\program files\Java
2009-08-28 22:05 . 2008-08-15 01:00 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-28 22:03 . 2008-08-15 01:00 ——– d—–w- c:\programdata\Symantec
2009-08-28 20:12 . 2009-06-15 19:42 ——– d—–w- c:\users\Sarina\AppData\Roaming\Azureus
2009-08-28 19:17 . 2009-06-15 19:41 ——– d—–w- c:\program files\Vuze
2009-08-27 01:57 . 2009-06-15 05:04 127856 —-a-w- c:\users\Sarina\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-27 01:49 . 2009-06-15 18:39 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2009-08-27 01:49 . 2008-08-14 19:01 ——– d—–w- c:\program files\Common Files\InstallShield
2009-08-26 14:43 . 2009-06-15 18:39 ——– d—–w- c:\users\Sarina\AppData\Roaming\Winamp
2009-08-13 05:05 . 2009-01-18 06:47 ——– d—–w- c:\programdata\Microsoft Help
2009-08-13 05:05 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-08-13 04:09 . 2009-06-15 17:58 ——– d—–w- c:\users\Sarina\AppData\Roaming\Yahoo!
2009-08-13 04:09 . 2009-06-15 17:58 ——– d—–w- c:\program files\Yahoo!
2009-08-13 04:08 . 2009-06-15 17:58 ——– d—–w- c:\programdata\Yahoo!
2009-08-10 03:01 . 2009-06-23 01:31 ——– d—–w- c:\users\Sarina\AppData\Roaming\gtk-2.0
2009-08-04 03:58 . 2009-06-15 18:39 ——– d—–w- c:\program files\Winamp
2009-08-01 04:47 . 2009-06-15 23:29 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-01 04:44 . 2009-08-01 04:44 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2009-07-27 21:26 . 2009-06-15 18:16 ——– d—–w- c:\users\Sarina\AppData\Roaming\SecondLife
2009-07-25 17:56 . 2008-08-14 19:19 ——– d—–w- c:\programdata\CyberLink
2009-07-25 16:10 . 2009-07-25 16:10 746760 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-07-25 09:23 . 2009-06-28 01:10 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-07-21 21:52 . 2009-08-01 04:43 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-08-01 04:43 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-08-01 04:43 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-08-01 04:43 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-20 22:45 . 2009-07-20 22:45 ——– d—–w- c:\program files\iTunes
2009-07-20 22:45 . 2009-07-20 22:45 ——– d—–w- c:\program files\iPod
2009-07-20 22:45 . 2009-06-18 19:41 ——– d—–w- c:\program files\Common Files\Apple
2009-07-20 22:42 . 2009-07-20 22:42 75040 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-20 22:06 . 2009-06-15 21:31 ——– d—–w- c:\programdata\FLEXnet
2009-06-16 13:42 . 2009-06-16 13:41 14479040 —-a-w- c:\programdata\WildTangent\TOSHIBA Game Console\Downloads\en-us\Installers\SetupGamesClient.exe
2009-06-16 11:58 . 2009-06-16 11:58 652296 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2009-06-16 11:58 . 2009-06-16 11:58 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2009-06-15 20:02 . 2009-06-15 20:02 86016 —-a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2009-06-15 15:24 . 2009-07-15 15:35 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-15 15:35 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 15:35 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 15:35 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-06-15 05:03 . 2009-06-15 05:03 13 –sh–r- c:\windows\system32\drivers\fbd.sys
2009-06-15 05:03 . 2009-06-15 05:03 4 –sh–r- c:\windows\system32\drivers\taishop.sys
2009-06-05 15:42 . 2009-06-05 15:42 39424 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 15:42 . 2009-06-05 15:42 2060288 —-a-w- c:\windows\system32\usbaaplrc.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-30_19.33.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-08-30 19:54 54580 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-08-30 19:54 82876 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-06-15 05:04 . 2009-08-30 19:54 8820 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-737594619-1414829202-3786626943-1000_UserData.bin
- 2009-08-30 19:31 . 2009-08-30 19:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-08-30 19:51 . 2009-08-30 19:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2006-11-02 10:33 . 2009-08-30 19:29 595684 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-08-30 19:57 595684 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-08-30 19:29 101350 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-08-30 19:57 101350 c:\windows\System32\perfc009.dat
+ 2009-01-18 07:40 . 2009-08-30 19:50 1852152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2009-01-18 07:40 . 2009-08-30 19:30 1852152 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 13:55 1090816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-07-31 417792]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-02-06 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-11-01 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-06-16 448080]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
"ToshibaServiceStation"="c:\program files\TOSHIBA\TOSHIBA Service Station\TSS.exe" [2008-08-04 1242424]
"PCMAgent"="c:\program files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
"CLMLServer"="c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-28 2007832]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-04-08 6037504]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\users\Sarina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-5-22 139776]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{37E430F4-5480-440F-B2D7-D711B3DDB7C7}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\PowerCinema.exe:CyberLink PowerCinema
"{AE87CBDF-C7A6-4D36-89B5-E9764299ED33}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\PCMService.exe:CyberLink PowerCinema Resident Program
"{09B4A36F-378B-4103-8749-232DA98F40B4}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{19B80962-D2B7-4047-A5D1-352865D490EF}"= c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{E908A6B6-BCA2-4F8D-AC2B-1160405AF868}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{04F279D6-91BB-450B-BC97-32B7AEA59D33}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{5D4D92D6-3789-4AE6-979E-0816486466B2}c:\\program files\\secondlife\\slvoice.exe"= UDP:c:\program files\secondlife\slvoice.exe:SLVoice
"UDP Query User{0DDE2AC6-C1FC-4AFC-A313-8A6AE04FA347}c:\\program files\\secondlife\\slvoice.exe"= TCP:c:\program files\secondlife\slvoice.exe:SLVoice
"{22BF6ED7-26FD-45C5-ACB8-0A7E6CB9A65E}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{1EB8BC87-AE9F-4C61-AD13-E4CCE057BDF7}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{DC41B99C-E470-47F9-8DE0-71BE9C4EA69F}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8F82FA6F-6CE5-4B44-81E2-ED8D12378BD3}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{97DEC7D4-815A-4E50-9CCB-B78C53F1ADCA}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D5AC89BA-8157-4666-9019-549F8A16ECAA}"= UDP:5353:Adobe CSI CS4
"{1130C0ED-AF58-49D9-BE07-5339227A3478}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{C8C3851C-720C-41D3-8C7B-D2AEE687BE91}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{6F3F84AE-F792-4C72-8F79-08914ADB68E7}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{ECC5E097-4CCA-45E0-A456-DD6C385CEFF0}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{85156AAE-9C73-4CB1-9CFF-7C2F450C5B01}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9C01F557-C3DC-4AF0-B9EE-69CEAA2A6E99}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{25763E55-BB52-43D8-A044-796252B25BFA}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{6BF94468-B003-4E24-AD70-FD7C29EC7627}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F9B241F-AF17-447D-8900-6CF601045046}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{409E9E76-EB2C-418E-A69D-BAFD07258428}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{303764CE-4948-4028-8517-3BF34AE0E28D}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [8/28/2009 6:22 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [8/28/2009 6:22 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/28/2009 6:21 PM 297752]
R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [7/10/2008 8:58 PM 40960]
R2 TMachInfo;TMachInfo;c:\program files\Toshiba\TOSHIBA Service Station\TMachInfo.exe [8/14/2008 3:15 PM 46392]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [12/3/2007 9:03 PM 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [8/14/2008 3:08 PM 7168]
R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\System32\drivers\NETw5v32.sys [4/28/2008 10:29 AM 3658752]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [4/24/2008 10:35 PM 73728]
S2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [3/30/2009 4:28 PM 1533808]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [6/15/2009 7:28 PM 55280]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 6:08 PM 533360]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 SVRPEDRV;SVRPEDRV;c:\windows\System32\sysprep\PEDRV.SYS [8/20/2008 2:41 PM 9216]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\users\Sarina\AppData\Roaming\Mozilla\Firefox\Profiles\auzck6vf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: google.toolbar.linkdoctor.enabled - false
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 22:29
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-08-31 22:31
ComboFix-quarantined-files.txt 2009-08-31 02:31
ComboFix2.txt 2009-08-30 19:39

Pre-Run: 265,607,794,688 bytes free
Post-Run: 265,525,358,592 bytes free

348 — E O F — 2009-08-27 03:32
Upload was successful

Raktor

Post #8August 31, 2009, 3:15 AM UTC

1) P2P Warning
P2P - I see you have P2P software (LimeWire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

2) Java
Your version of Java is outdated.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

3) MBAM
Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

4) ESET
As you are running Windows Vista, please open your browser for this scan by right clicking on it, and clicking Run As Administrator. Ensure that you close your browser after this scan.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

5) What You Will Need To Post:

MBAM log
ESET log

Sarina

Post #9August 31, 2009, 9:49 AM UTC last edited August 31, 2009, 9:51 AM UTC

Here are the logs you asked for Malwarebytes' Anti-Malware 1.40 Database version: 2720 Windows 6.0.6001 Service Pack 1 8/31/2009 12:00:36 AM mbam-log-2009-08-31 (00-00-36).txt Scan type: Quick Scan Objects scanned: 90700 Time elapsed: 6 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Windows\System32\hnei.exe (Trojan.Dropper) -> Quarantined and deleted successfully. ESETSmartInstaller@High as downloader log: all ok # version=6 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6050 # api_version=3.0.2 # EOSSerial=ae88d0804130274a9b7db75afa01d0ef # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-08-31 05:49:10 # local_time=2009-08-31 01:49:10 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.0.6001 NT Service Pack 1 # compatibility_mode=1026 61 83 100 1996470139239 # compatibility_mode=5889 61 66 100 508155377318746 # scanned=175532 # found=13 # cleaned=0 # scan_time=5857 C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmbvotsfmc_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmdtpxsmtx_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmfacpvtmt_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmfwblvelm_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmkgvsmwip_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmpmyjnbyr_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmpvbrorpq_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmrmuetjim_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmrpltbdux_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmttmpxnwq_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmvqcneqyi_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Qoobox\Quarantine\C\Windows\System32\drivers\_kbiwkmwdmopwee_.sys.zip a variant of Win32/Rootkit.Kryptik.I trojan 00000000000000000000000000000000 I C:\Users\Sarina\Downloads\SDFix.exe Win32/PrcView application 00000000000000000000000000000000 I

Raktor

Post #10August 31, 2009, 10:25 AM UTC

How is the system going now - any remaining issues?

Sarina

Post #11August 31, 2009, 11:33 AM UTC

The system seems to be much better now, I am able to get into any websites without the issue I was having. It does seem a bit slow on start up but other than that everything seems to be back to normal. Do I need to worry about the files that were found in the Qoobox? I just want to thank you very much for the time you have spent helping me to fix the issues in my system! It is greatly appreciated!

Raktor

Post #12August 31, 2009, 11:39 AM UTC last edited August 31, 2009, 11:40 AM UTC

Then congratulations, you're looking all clean.

I'll give you my speed up instructions for Vista, and we'll also remove Combofix - which will clean out that Qoobox folder for you.

===========================

For a bit of a speed up….

1) TFC
Please download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should reboot your machine, if not, manually reboot to ensure a complete clean

2) chkdsk

Close any open windows.
Go to the Start Menu, type in cmd.exe
Right click on cmd.exe, and click Run as Administrator
In the command window that appears, type chkdsk /r, and press enter
Agree to any prompts - then reboot the computer.
chkdsk should run as you boot the machine up - this will check the harddrive for damaged sectors and attempt to repair them.

3) Defrag

Close any open windows.
Go to the Start Menu, type in Defrag
Defrag all drives in the Disk Defragmenter

===========================

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
[external image: Posted Image]

The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.

You may also manually remove any programs I have had you download, and any logs that have been produced, except MBAM. MBAM is my present to you - keep it, update it, and run it weekly!

===========================

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other

4. Make sure you keep your Windows OS current by using Windows Update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.
Important! Windows Vista requires special instructions for a custom Hosts file. Please see here

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

8. Finally, I strongly recommend that you read Miekiemoses' good advice - How to prevent Malware

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Sarina

Post #13August 31, 2009, 5:00 PM UTC

Thank you so much for all of your help! Your quick responses and excellent help was greatly appreciated!

Raktor

Post #14September 1, 2009, 4:58 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Internet browsing issues

✨ Ask AI

Ask AI