What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Gmail Redirect - ezcoolpages

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
When I try to access Gmail by typing in mail.google.com, I am redirected to an address with ezcoolpages in the url. Have not been successful with accessing my Gmail webmail except by using Opera browser to fetch my messages. I have webroot security essentials and it has removed several trojans but can't fix the ezcoolpages problem. Here are my mbam, gmer and dds logs.

Malwarebytes' Anti-Malware 1.44
Database version: 3527
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/9/2010 10:00:03 AM
mbam-log-2010-01-09 (10-00-03).txt

Scan type: Quick Scan
Objects scanned: 151109
Time elapsed: 8 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\Rabio (Adware.Rabio) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.Rabio) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\tdlcmd.dll (Trojan.TDSS) -> Quarantined and deleted successfully.


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-09 12:22:39
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Jaret\LOCALS~1\Temp\kgloapog.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwAdjustPrivilegesToken [0xEFCB46B0]
SSDT 82FCF718 ZwAllocateVirtualMemory
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwConnectPort [0xEFCB4BB0]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreateFile [0xEFCB3510]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreateKey [0xEFCB4370]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreatePort [0xEFCB4F10]
SSDT 82FB0358 ZwCreateProcess
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreateProcessEx [0xEFCB5870]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreateSection [0xEFCB5170]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwCreateThread [0xEFCB5470]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwDebugActiveProcess [0xEFCB3E80]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwDeleteKey [0xEFCB2080]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwDeleteValueKey [0xEFCB21E0]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwDeviceIoControlFile [0xEFCB3F80]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwOpenFile [0xEFCB37A0]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwOpenProcess [0xEFCB23A0]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwOpenSection [0xEFCB3A10]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwOpenThread [0xEFCB4570]
SSDT 82FC72C0 ZwQueueApcThread
SSDT 82FCF628 ZwReadVirtualMemory
SSDT 82F6DD48 ZwRenameKey
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwResumeThread [0xEFCB2610]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwSecureConnectPort [0xEFCB4D60]
SSDT 82FAD510 ZwSetContextThread
SSDT 82FE61A8 ZwSetInformationKey
SSDT 82FAE5A8 ZwSetInformationProcess
SSDT 82FE1238 ZwSetInformationThread
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwSetValueKey [0xEFCB1EE0]
SSDT 82FCD120 ZwSuspendProcess
SSDT 82FC7338 ZwSuspendThread
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwTerminateProcess [0xEFCB1DD0]
SSDT \SystemRoot\system32\drivers\pwipf6.sys (pwipf6/Privacyware/PWI, Inc.) ZwTerminateThread [0xEFCB24F0]
SSDT 82FCF6A0 ZwWriteVirtualMemory

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \Driver\Tcpip \Device\Ip 82C47D98
Device \Driver\Tcpip \Device\Ip 82F67640
Device \Driver\Tcpip \Device\Ip 82BFBB90

AttachedDevice \Driver\Tcpip \Device\Ip pwipf6.sys (pwipf6/Privacyware/PWI, Inc.)

Device \Driver\Tcpip \Device\Tcp 82C47D98
Device \Driver\Tcpip \Device\Tcp 82F67640
Device \Driver\Tcpip \Device\Tcp 82BFBB90

AttachedDevice \Driver\Tcpip \Device\Tcp pwipf6.sys (pwipf6/Privacyware/PWI, Inc.)

Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 [F854EB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F854EB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort0 [F854EB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort1 [F854EB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f [F854EB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\Tcpip \Device\Udp 82C47D98
Device \Driver\Tcpip \Device\Udp 82F67640
Device \Driver\Tcpip \Device\Udp 82BFBB90

AttachedDevice \Driver\Tcpip \Device\Udp pwipf6.sys (pwipf6/Privacyware/PWI, Inc.)

Device \Driver\Tcpip \Device\RawIp 82C47D98
Device \Driver\Tcpip \Device\RawIp 82F67640
Device \Driver\Tcpip \Device\RawIp 82BFBB90

AttachedDevice \Driver\Tcpip \Device\RawIp pwipf6.sys (pwipf6/Privacyware/PWI, Inc.)

Device \Driver\Tcpip \Device\IPMULTICAST 82C47D98
Device \Driver\Tcpip \Device\IPMULTICAST 82F67640
Device \Driver\Tcpip \Device\IPMULTICAST 82BFBB90

AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-




DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:24:41.82 on Sat 01/09/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.193 [GMT -6:00]

AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
FW: Webroot Internet Security Essentials *disabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}

============== Running Processes ===============

C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\mshta.exe
C:\WINDOWS\system32\mshta.exe
C:\Documents and Settings\Jaret\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearch Page =
uDefault_Page_URL = hxxp://www.rr.com
uWindow Title = Windows Internet Explorer provided by Road Runner
mSearchAssistant =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {3626C3BA-D29E-4300-8C9A-63036791DD97} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {6d48e056-1dd2-11b2-9c5f-8a81e51d4dd7} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: GloveBHO Class: {9782d730-5648-4eb0-ab4e-fe82f580485a} - c:\program files\glove\Glove.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: {CB4CCE85-CD04-4672-8A56-D49881636AA4} - No File
BHO: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ctfmon.exe] "c:\windows\system32\ctfmon.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [EPSON Stylus CX9400Fax Series] "c:\windows\system32\spool\drivers\w32x86\3\e_faticfa.exe" /fu "c:\windows\temp\E_S17.tmp" /EF "HKCU"
uRun: [EPSON WorkForce 600(Network)] "c:\windows\system32\spool\drivers\w32x86\3\e_fatieka.exe" /fu "c:\windows\temp\E_S75.tmp" /EF "HKCU"
mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe"
mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"
mRun: [DLA] "c:\windows\system32\dla\DLACTRLW.EXE"
mRun: [Persistence] "c:\windows\system32\igfxpers.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [HotSync] "c:\program files\palmsource\desktop\HotSync.exe" -AllUsers
mRun: [SpySweeper] "c:\program files\webroot\webrootsecurity\SpySweeperUI.exe" /startintray
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe
uPolicies-explorer: NoThumbnailCache = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: &Google Search
IE: &Search
IE: &Translate English Word
IE: Backward Links
IE: Cached Snapshot of Page
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Similar Pages
IE: Translate Page into English
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F4430FE8-2638-42e5-B849-800749B94EED}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://games.pogo.com/online2/pogo/zuma/popcaploader_v5.cab
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: igfxcui - igfxdev.dll
Notify: rqRIyVpm - rqRIyVpm.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\vtUnkjKb

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jaret\applic~1\mozilla\firefox\profiles\3gaeukj9.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_ZangoSA.dll
FF - plugin: c:\program files\opera\program\plugins\NPSIStub.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [2009-12-10 108880]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-12-5 1201640]
S3 WDMStreaming;WDM Streaming Standard Interface Handler Service;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]

=============== Created Last 30 ================

2010-01-01 04:58 1,089,593 ——– c:\windows\system32\dllcache\ntprint.cat
2009-12-31 10:59 –d—– c:\windows\system32\XPSViewer
2009-12-31 10:57 117,760 ——– c:\windows\system32\prntvpt.dll
2009-12-31 10:57 89,088 ——– c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-31 10:57 597,504 ——– c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-31 10:57 575,488 ——– c:\windows\system32\xpsshhdr.dll
2009-12-31 10:57 575,488 ——– c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-31 10:57 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2009-12-31 10:57 1,676,288 ——– c:\windows\system32\dllcache\xpssvcs.dll
2009-12-31 10:57 –d—– C:\319897dbb7804b41f829
2009-12-18 11:47 437 a——- C:\4.js
2009-12-11 18:34 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-11 18:34 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-12-11 18:34 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-12-10 22:02 108,880 a——- c:\windows\system32\drivers\pwipf6.sys

==================== Find3M ====================

2009-11-25 11:30 348,160 a——- c:\windows\system32\msvcr71.dll
2009-11-25 11:30 499,712 a——- c:\windows\system32\msvcp71.dll
2009-11-06 15:19 1,563,008 a——- c:\windows\WRSetup.dll
2009-10-28 08:40 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-10-20 23:38 75,776 a——- c:\windows\system32\strmfilt.dll
2009-10-20 23:38 25,088 a——- c:\windows\system32\httpapi.dll
2009-10-20 23:38 75,776 ——– c:\windows\system32\dllcache\strmfilt.dll
2009-10-20 23:38 25,088 ——– c:\windows\system32\dllcache\httpapi.dll
2009-10-20 10:20 265,728 ——– c:\windows\system32\dllcache\http.sys
2009-10-13 04:30 270,336 a——- c:\windows\system32\oakley.dll
2009-10-13 04:30 270,336 ——– c:\windows\system32\dllcache\oakley.dll
2009-10-12 07:38 149,504 a——- c:\windows\system32\rastls.dll
2009-10-12 07:38 149,504 ——– c:\windows\system32\dllcache\rastls.dll
2009-10-12 07:38 79,872 a——- c:\windows\system32\raschap.dll
2009-10-12 07:38 79,872 ——– c:\windows\system32\dllcache\raschap.dll
2009-01-24 18:47 56 —shr– c:\windows\system32\3CEFB3BCE7.sys
2008-05-23 12:09 788,120 ac-sh— c:\windows\system32\bKjknUtv.ini2
2008-06-11 08:50 1,621,951 -c-sh— c:\windows\system32\jwgsompr.ini2
2009-01-24 18:47 2,620 a–sh— c:\windows\system32\KGyGaAvL.sys
2008-10-13 17:50 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008101320081014\index.dat

============= FINISH: 12:26:39.75 ===============
Post #2
Hello User and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instruction I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #3
jwessel22,

You are infected with a rootkit. You should reset your passwords from a machine you know is clean.

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #4
Here is the Combofix log -

ComboFix 10-01-04.01 - Jaret 01/09/2010 21:41:12.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.287 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
FW: Webroot Internet Security Essentials *disabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Rabio
c:\progra~1\Webroot\WEBROO~1\Backup\ntSVc.ocx
c:\program files\Glove\GlOVe.dll
c:\program files\RcvSystem
c:\program files\Search Guard PlusU
c:\program files\Search Guard PlusU\SGPU.ico
c:\program files\Search Guard PlusU\sgpUpdater.xml
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\11478.exe
c:\windows\system32\11538.exe
c:\windows\system32\11942.exe
c:\windows\system32\12382.exe
c:\windows\system32\12859.exe
c:\windows\system32\14604.exe
c:\windows\system32\14771.exe
c:\windows\system32\15141.exe
c:\windows\system32\153.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\17035.exe
c:\windows\system32\17421.exe
c:\windows\system32\17673.exe
c:\windows\system32\18467.exe
c:\windows\system32\1869.exe
c:\windows\system32\18716.exe
c:\windows\system32\19169.exe
c:\windows\system32\19718.exe
c:\windows\system32\19895.exe
c:\windows\system32\19912.exe
c:\windows\system32\20037.exe
c:\windows\system32\21726.exe
c:\windows\system32\23281.exe
c:\windows\system32\23811.exe
c:\windows\system32\24464.exe
c:\windows\system32\25547.exe
c:\windows\system32\25667.exe
c:\windows\system32\26299.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\27529.exe
c:\windows\system32\27644.exe
c:\windows\system32\28145.exe
c:\windows\system32\28253.exe
c:\windows\system32\28703.exe
c:\windows\system32\292.exe
c:\windows\system32\29358.exe
c:\windows\system32\2995.exe
c:\windows\system32\30333.exe
c:\windows\system32\31322.exe
c:\windows\system32\32391.exe
c:\windows\system32\32662.exe
c:\windows\system32\32757.exe
c:\windows\system32\3902.exe
c:\windows\system32\4664.exe
c:\windows\system32\4827.exe
c:\windows\system32\491.exe
c:\windows\system32\5436.exe
c:\windows\system32\5447.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\6868.exe
c:\windows\system32\7711.exe
c:\windows\system32\778.exe
c:\windows\system32\8723.exe
c:\windows\system32\9741.exe
c:\windows\system32\9894.exe
c:\windows\system32\9961.exe
c:\windows\system32\aammbtfc.ini
c:\windows\system32\bKjknUtv.ini
c:\windows\system32\bKjknUtv.ini2
c:\windows\system32\bsgeftjj.ini
c:\windows\system32\fjvqtgub.ini
c:\windows\system32\jwgsompr.ini
c:\windows\system32\jwgsompr.ini2
c:\windows\system32\jwgsompr.tmp
c:\windows\system32\logtwbpd.ini
c:\windows\system32\mqemsmlu.ini
c:\windows\system32\odwychuy.ini
c:\windows\system32\ohavjiln.ini
c:\windows\system32\ttttelus.ini
c:\windows\system32\xoovjquj.ini
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
D:\Autorun.inf
F:\INSTALL.EXE

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Files Created from 2009-12-10 to 2010-01-10 )))))))))))))))))))))))))))))))
.

2010-01-05 03:04 . 2010-01-05 03:04 ——– d—–w- c:\documents and settings\Jaret\Application Data\HotSync
2009-12-31 17:17 . 2009-12-31 17:17 ——– d—–w- c:\program files\ERUNT
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\program files\Reference Assemblies
2009-12-31 16:58 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-31 16:57 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-31 16:57 . 2009-12-31 16:59 ——– d—–w- C:\319897dbb7804b41f829
2009-12-22 00:49 . 2009-12-22 00:49 ——– d-sh–w- c:\documents and settings\MATT\PrivacIE
2009-12-22 00:44 . 2009-12-22 00:44 ——– d—–w- c:\documents and settings\MATT\Application Data\Webroot
2009-12-22 00:43 . 2009-12-22 00:43 127 —-a-w- c:\documents and settings\MATT\Local Settings\Application Data\fusioncache.dat
2009-12-22 00:42 . 2009-12-22 00:42 ——– d-sh–w- c:\documents and settings\MATT\IETldCache
2009-12-22 00:21 . 2009-12-22 00:21 ——– d-sh–w- c:\documents and settings\Jacob\PrivacIE
2009-12-21 23:41 . 2009-12-21 23:41 ——– d—–w- c:\documents and settings\Jacob\Application Data\Webroot
2009-12-21 23:41 . 2009-12-21 23:41 128 —-a-w- c:\documents and settings\Jacob\Local Settings\Application Data\fusioncache.dat
2009-12-21 23:40 . 2009-12-21 23:40 ——– d-sh–w- c:\documents and settings\Jacob\IETldCache
2009-12-18 17:47 . 2009-12-18 17:47 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-12-18 16:40 . 2009-12-18 16:40 ——– d—–w- c:\documents and settings\ELIZABETH\Local Settings\Application Data\Opera
2009-12-12 04:06 . 2009-12-12 04:06 ——– d—–w- c:\documents and settings\Jaret\Local Settings\Application Data\Opera
2009-12-12 04:05 . 2009-12-12 04:05 ——– d—–w- c:\program files\Opera
2009-12-12 00:34 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-12 00:34 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-12 00:34 . 2010-01-09 15:45 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-11 04:02 . 2009-12-11 03:59 108880 —-a-w- c:\windows\system32\drivers\pwipf6.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 03:48 . 2008-08-07 17:53 ——– d—–w- c:\program files\Glove
2010-01-09 15:44 . 2009-12-31 17:31 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-09 13:56 . 2008-09-09 00:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-05 12:58 . 2009-01-16 01:36 ——– d—–w- c:\program files\thinkorswim
2010-01-05 03:11 . 2009-04-29 03:30 ——– d—–w- c:\documents and settings\Jaret\Application Data\Arcsoft
2010-01-05 03:11 . 2009-04-22 03:47 ——– d—–w- c:\program files\Palm
2009-12-31 17:14 . 2009-01-30 03:37 106272 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-31 16:59 . 2009-01-24 00:07 ——– d—–w- c:\program files\MSBuild
2009-12-11 04:42 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\Jaret\Application Data\Webroot
2009-12-11 04:00 . 2009-12-05 19:01 164 —-a-w- c:\windows\install.dat
2009-12-09 03:15 . 2009-01-23 23:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-08 03:22 . 2009-12-08 03:22 ——– d—–w- c:\documents and settings\ELIZABETH\Application Data\Webroot
2009-12-06 06:11 . 2004-08-10 17:51 ——– d—–w- c:\program files\Common Files\WDMStreaming
2009-12-06 05:21 . 2009-10-10 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\CA
2009-12-05 19:21 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2009-12-05 19:10 . 2009-12-05 19:10 ——– d—–w- c:\program files\Ask.com
2009-12-05 19:09 . 2009-12-05 19:09 128 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\fusioncache.dat
2009-12-05 19:08 . 2009-12-05 19:08 ——– d—–w- c:\program files\MSSOAP
2009-12-05 19:06 . 2009-12-05 19:06 ——– d—–w- c:\program files\Webroot
2009-12-05 17:22 . 2009-11-03 03:06 ——– d—–w- c:\program files\RegistryFix8
2009-12-05 04:01 . 2006-08-22 02:00 ——– d—–w- c:\program files\Common Files\Adobe
2009-11-25 17:32 . 2006-08-18 02:32 ——– d—–w- c:\program files\Common Files\Real
2009-11-25 17:32 . 2009-11-25 17:32 ——– d—–w- c:\program files\Common Files\xing shared
2009-11-25 17:30 . 2003-02-21 09:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2009-11-25 17:30 . 2003-03-19 01:14 499712 —-a-w- c:\windows\system32\msvcp71.dll
2009-11-25 17:30 . 2009-11-25 17:30 ——– d—–w- c:\program files\Real
2009-11-21 19:28 . 2008-10-21 20:30 ——– d—–w- c:\program files\Oberon Media
2009-11-21 19:25 . 2006-10-08 23:58 ——– d—–w- c:\program files\PartyGaming.Net
2009-11-21 19:07 . 2008-12-08 03:42 ——– d—–w- c:\program files\OpenOffice.org 3
2009-11-21 19:00 . 2007-05-31 14:19 ——– d—–w- c:\program files\Mobile Video Converter
2009-11-17 14:25 . 2009-01-24 00:07 ——– d—–w- c:\program files\Microsoft Works
2009-11-06 21:19 . 2009-12-05 19:06 1563008 —-a-w- c:\windows\WRSetup.dll
2009-11-06 18:00 . 2009-11-06 18:00 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
2009-11-06 18:00 . 2009-11-06 18:00 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-11-06 18:00 . 2009-11-06 18:00 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2009-11-04 02:28 . 2009-11-04 02:28 23 –sha-w- c:\windows\system32\edacded0.dat
2009-10-29 07:45 . 2004-08-10 17:51 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-10 17:51 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-10 17:51 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 04:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-10 17:51 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-10 17:51 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-10 17:51 79872 —-a-w- c:\windows\system32\raschap.dll
2009-01-25 00:47 . 2008-10-20 18:25 56 –sh–r- c:\windows\system32\3CEFB3BCE7.sys
2009-01-25 00:47 . 2007-03-07 16:21 2620 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 21:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-06 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-06 77824]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-06 114688]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-25 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

c:\documents and settings\LORENZO\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\MATT\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Sprint media monitor.lnk - c:\windows\RM.exe [2008-12-8 222552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spyzyvwj

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [11/6/2009 12:00 PM 29808]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [12/10/2009 10:02 PM 108880]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [12/5/2009 1:12 PM 1201640]
S3 WDMStreaming;WDM Streaming Standard Interface Handler Service;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 11:51 AM 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
WDMStreaming
.
Contents of the 'Scheduled Tasks' folder

2010-01-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2010-01-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 02:59]

2010-01-10 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 21:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
IE: &Google Search
IE: &Search
IE: &Translate English Word
IE: Backward Links
IE: Cached Snapshot of Page
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Similar Pages
IE: Translate Page into English
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
FF - ProfilePath - c:\documents and settings\Jaret\Application Data\Mozilla\Firefox\Profiles\3gaeukj9.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Opera\program\plugins\NPSIStub.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{3626C3BA-D29E-4300-8C9A-63036791DD97} - (no file)
HKLM-Run-HotSync - c:\program files\PalmSource\Desktop\HotSync.exe
Notify-rqRIyVpm - rqRIyVpm.dll
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-09 21:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3716)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
.
**************************************************************************
.
Completion time: 2010-01-09 22:01:31 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-10 04:01

Pre-Run: 89,695,109,120 bytes free
Post-Run: 89,541,976,064 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 0607F9720A5DDA545BF5FC395CD62345
Post #5
jwessel22,

Looks like we are making progress. Here are your next instructions:


🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Registry::


Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spyzyvwj]

Folder::
c:\program files\Glove

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Scan with Malwarebytes

  • Open, then update the program.
  • If an update is found, it will download and install the latest version.
  • Once the program has updated, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
🖼Click to load external image (Posted Image) I'd like for you to run this next online scan to check for remnants or anything that might be hidden.
The below scan can take up to an hour or longer, please be patient.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so no conflicts and to speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware app you use.


Please do a scan with Kaspersky Online Scanner or from here
http://www.kaspersky.com/virusscanner

  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.

Animated tutorial
http://i275.photobucket.com/albums/jj285/B…ng/KAS/KAS9.gif

(Note.. for Internet Explorer 7 users:
If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
Or use Firefox with IE-Tab plugin
https://addons.mozilla.org/en-US/firefox/addon/1419

In your next reply post:
  • ComboFix log
  • MBAM log
  • Kaspersky log
Also let me know what, if any problems you are still having with your computer.
Post #6
I can access my Gmail without being redirected. Thanks! Here are the Combofix, MBam and Kapersky logs -

ComboFix 10-01-04.01 - Jaret 01/10/2010 19:44:22.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.226 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jaret\Desktop\CFScript.txt
AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
FW: Webroot Internet Security Essentials *disabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Glove
c:\program files\Glove\Glove.dll.intermediate.manifest
c:\program files\Glove\Glove.info
c:\program files\Glove\Glove.original
c:\program files\Glove\Gloverg.dll
c:\program files\Glove\un_GloveSetup_16754.exe
c:\program files\Glove\un_GloveSetup_16754.txt
c:\program files\Glove\X_Glove.log

.
((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-10 04:29 . 2010-01-10 04:29 ——– d—–w- c:\documents and settings\MATT\Application Data\HotSync
2010-01-05 03:04 . 2010-01-05 03:04 ——– d—–w- c:\documents and settings\Jaret\Application Data\HotSync
2009-12-31 17:31 . 2010-01-09 15:44 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-31 17:17 . 2009-12-31 17:17 ——– d—–w- c:\program files\ERUNT
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\program files\Reference Assemblies
2009-12-31 16:58 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-31 16:57 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-31 16:57 . 2009-12-31 16:59 ——– d—–w- C:\319897dbb7804b41f829
2009-12-22 00:49 . 2009-12-22 00:49 ——– d-sh–w- c:\documents and settings\MATT\PrivacIE
2009-12-22 00:44 . 2009-12-22 00:44 ——– d—–w- c:\documents and settings\MATT\Application Data\Webroot
2009-12-22 00:43 . 2009-12-22 00:43 127 —-a-w- c:\documents and settings\MATT\Local Settings\Application Data\fusioncache.dat
2009-12-22 00:42 . 2009-12-22 00:42 ——– d-sh–w- c:\documents and settings\MATT\IETldCache
2009-12-22 00:21 . 2009-12-22 00:21 ——– d-sh–w- c:\documents and settings\Jacob\PrivacIE
2009-12-21 23:41 . 2009-12-21 23:41 ——– d—–w- c:\documents and settings\Jacob\Application Data\Webroot
2009-12-21 23:41 . 2009-12-21 23:41 128 —-a-w- c:\documents and settings\Jacob\Local Settings\Application Data\fusioncache.dat
2009-12-21 23:40 . 2009-12-21 23:40 ——– d-sh–w- c:\documents and settings\Jacob\IETldCache
2009-12-18 17:47 . 2009-12-18 17:47 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-12-18 16:40 . 2009-12-18 16:40 ——– d—–w- c:\documents and settings\ELIZABETH\Local Settings\Application Data\Opera
2009-12-12 04:06 . 2009-12-12 04:06 ——– d—–w- c:\documents and settings\Jaret\Local Settings\Application Data\Opera
2009-12-12 04:05 . 2009-12-12 04:05 ——– d—–w- c:\program files\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 01:34 . 2008-09-09 00:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-09 15:45 . 2009-12-12 00:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-07 22:07 . 2009-12-12 00:34 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2009-12-12 00:34 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 12:58 . 2009-01-16 01:36 ——– d—–w- c:\program files\thinkorswim
2010-01-05 03:11 . 2009-04-29 03:30 ——– d—–w- c:\documents and settings\Jaret\Application Data\Arcsoft
2010-01-05 03:11 . 2009-04-22 03:47 ——– d—–w- c:\program files\Palm
2009-12-31 17:14 . 2009-01-30 03:37 106272 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-31 16:59 . 2009-01-24 00:07 ——– d—–w- c:\program files\MSBuild
2009-12-11 04:42 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\Jaret\Application Data\Webroot
2009-12-11 04:00 . 2009-12-05 19:01 164 —-a-w- c:\windows\install.dat
2009-12-11 03:59 . 2009-12-11 04:02 108880 —-a-w- c:\windows\system32\drivers\pwipf6.sys
2009-12-09 03:15 . 2009-01-23 23:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-08 03:22 . 2009-12-08 03:22 ——– d—–w- c:\documents and settings\ELIZABETH\Application Data\Webroot
2009-12-06 06:11 . 2004-08-10 17:51 ——– d—–w- c:\program files\Common Files\WDMStreaming
2009-12-06 05:21 . 2009-10-10 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\CA
2009-12-05 19:21 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2009-12-05 19:10 . 2009-12-05 19:10 ——– d—–w- c:\program files\Ask.com
2009-12-05 19:09 . 2009-12-05 19:09 128 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\fusioncache.dat
2009-12-05 19:08 . 2009-12-05 19:08 ——– d—–w- c:\program files\MSSOAP
2009-12-05 19:06 . 2009-12-05 19:06 ——– d—–w- c:\program files\Webroot
2009-12-05 17:22 . 2009-11-03 03:06 ——– d—–w- c:\program files\RegistryFix8
2009-12-05 04:01 . 2006-08-22 02:00 ——– d—–w- c:\program files\Common Files\Adobe
2009-11-25 17:32 . 2006-08-18 02:32 ——– d—–w- c:\program files\Common Files\Real
2009-11-25 17:32 . 2009-11-25 17:32 ——– d—–w- c:\program files\Common Files\xing shared
2009-11-25 17:30 . 2003-02-21 09:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2009-11-25 17:30 . 2003-03-19 01:14 499712 —-a-w- c:\windows\system32\msvcp71.dll
2009-11-25 17:30 . 2009-11-25 17:30 ——– d—–w- c:\program files\Real
2009-11-21 19:28 . 2008-10-21 20:30 ——– d—–w- c:\program files\Oberon Media
2009-11-21 19:25 . 2006-10-08 23:58 ——– d—–w- c:\program files\PartyGaming.Net
2009-11-21 19:07 . 2008-12-08 03:42 ——– d—–w- c:\program files\OpenOffice.org 3
2009-11-21 19:00 . 2007-05-31 14:19 ——– d—–w- c:\program files\Mobile Video Converter
2009-11-17 14:25 . 2009-01-24 00:07 ——– d—–w- c:\program files\Microsoft Works
2009-11-06 21:19 . 2009-12-05 19:06 1563008 —-a-w- c:\windows\WRSetup.dll
2009-11-06 18:00 . 2009-11-06 18:00 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
2009-11-06 18:00 . 2009-11-06 18:00 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-11-06 18:00 . 2009-11-06 18:00 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2009-11-04 02:28 . 2009-11-04 02:28 23 –sha-w- c:\windows\system32\edacded0.dat
2009-10-29 07:45 . 2004-08-10 17:51 916480 ——w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-10 17:51 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-10 17:51 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 04:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-08-10 17:51 270336 —-a-w- c:\windows\system32\oakley.dll
2009-01-25 00:47 . 2008-10-20 18:25 56 –sh–r- c:\windows\system32\3CEFB3BCE7.sys
2009-01-25 00:47 . 2007-03-07 16:21 2620 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 21:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-06 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-06 77824]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-06 114688]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-25 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

c:\documents and settings\LORENZO\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\MATT\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Sprint media monitor.lnk - c:\windows\RM.exe [2008-12-8 222552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [11/6/2009 12:00 PM 29808]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [12/10/2009 10:02 PM 108880]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [12/5/2009 1:12 PM 1201640]
S3 WDMStreaming;WDM Streaming Standard Interface Handler Service;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 11:51 AM 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
WDMStreaming
.
Contents of the 'Scheduled Tasks' folder

2010-01-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2010-01-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 02:59]

2010-01-10 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 21:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
IE: &Google Search
IE: &Search
IE: &Translate English Word
IE: Backward Links
IE: Cached Snapshot of Page
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Similar Pages
IE: Translate Page into English
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
FF - ProfilePath - c:\documents and settings\Jaret\Application Data\Mozilla\Firefox\Profiles\3gaeukj9.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Glove - c:\program files\Glove\un_GloveSetup_16754.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-10 19:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
Completion time: 2010-01-10 19:54:47
ComboFix-quarantined-files.txt 2010-01-11 01:54
ComboFix2.txt 2010-01-10 04:01

Pre-Run: 89,541,980,160 bytes free
Post-Run: 89,510,678,528 bytes free

- - End Of File - - 409D802A96548D3A1E1807681010638C


Malwarebytes' Anti-Malware 1.44
Database version: 3538
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/10/2010 9:19:55 PM
mbam-log-2010-01-10 (21-19-55).txt

Scan type: Full Scan (A:\|C:\|D:\|E:\|F:\|Z:\|)
Objects scanned: 360298
Time elapsed: 1 hour(s), 18 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP12\A0004823.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP26\A0010732.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP26\A0010908.sys (Malware.Trace) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000507.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.


——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, January 11, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, January 11, 2010 03:42:37
Records in database: 3297499
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
Z:\

Scan statistics:
Objects scanned: 189420
Threats found: 7
Infected objects found: 5
Suspicious objects found: 4
Scan duration: 08:15:09


File name / Threat / Threats count
C:\2.js Suspicious: Trojan-Downloader.JS.gen 1
C:\3.js Suspicious: Trojan-Downloader.JS.gen 1
C:\4.js Suspicious: Trojan-Downloader.JS.gen 1
C:\Documents and Settings\Jaret\Desktop\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\Documents and Settings\LORENZO\My Documents\LimeWire\Saved\what hurts most by rascal(1).wma Infected: Trojan-Downloader.WMA.Wimad.y 1
C:\info.exe Infected: Packed.Win32.PolyCrypt.m 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP26\A0010709.sys Infected: Rootkit.Win32.TDSS.u 1
F:\WINDOWS\Downloaded Program Files\vxpspeeddelivery.dll Infected: not-a-virus:AdWare.Win32.SpeedDelivery.a 1
F:\Documents and Settings\Jaret Wessel\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1

Selected area has been scanned.
Post #7
jwessel22,

You are very welcome. We still have a little work to do though, then some important clean up, so please stick with me.

One of the infections identified by Kaspersky is in your Outlook email. Unfortunately Kaspersky is unable to identify which particular email is infected, so delete any emails from anyone you don't know or any that have attachments, such as jokes, videos etc. (don't open them to check).

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\Documents and Settings\Jaret\Desktop\vncviewer.exe
C:\Documents and Settings\LORENZO\My Documents\LimeWire\Saved\what hurts most by rascal(1).wma
C:\info.exe
C:\2.js
C:\3.js
C:\4.js
F:\WINDOWS\Downloaded Program Files\vxpspeeddelivery.dll

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
Post #8
We don't use Outlook and I couldn't find any suspicious Emails otherwise but I didn't look through the thousands of messages that are on webmail.

Here is the Combofix log -

ComboFix 10-01-11.01 - Jaret 01/11/2010 17:48:52.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.205 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jaret\Desktop\CFScript.txt
AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
FW: Webroot Internet Security Essentials *disabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}
* Resident AV is active


FILE ::
"C:\2.js"
"C:\3.js"
"C:\4.js"
"c:\documents and settings\Jaret\Desktop\vncviewer.exe"
"c:\documents and settings\LORENZO\My Documents\LimeWire\Saved\what hurts most by rascal(1).wma"
"C:\info.exe"
"f:\windows\Downloaded Program Files\vxpspeeddelivery.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2.js
C:\3.js
C:\4.js
c:\documents and settings\Jaret\Desktop\vncviewer.exe
c:\documents and settings\LORENZO\My Documents\LimeWire\Saved\what hurts most by rascal(1).wma
C:\info.exe
f:\windows\Downloaded Program Files\vxpspeeddelivery.dll

.
((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-11 23:39 . 2010-01-11 23:39 ——– d—–w- c:\documents and settings\Jacob\Local Settings\Application Data\Identities
2010-01-11 23:39 . 2010-01-11 23:39 ——– d—–w- c:\documents and settings\Jacob\Application Data\HotSync
2010-01-10 04:29 . 2010-01-10 04:29 ——– d—–w- c:\documents and settings\MATT\Application Data\HotSync
2010-01-05 03:04 . 2010-01-05 03:04 ——– d—–w- c:\documents and settings\Jaret\Application Data\HotSync
2009-12-31 17:31 . 2010-01-09 15:44 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-31 17:17 . 2009-12-31 17:17 ——– d—–w- c:\program files\ERUNT
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\windows\system32\XPSViewer
2009-12-31 16:59 . 2009-12-31 16:59 ——– d—–w- c:\program files\Reference Assemblies
2009-12-31 16:58 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-12-31 16:57 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-12-31 16:57 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-31 16:57 . 2009-12-31 16:59 ——– d—–w- C:\319897dbb7804b41f829
2009-12-22 00:49 . 2009-12-22 00:49 ——– d-sh–w- c:\documents and settings\MATT\PrivacIE
2009-12-22 00:44 . 2009-12-22 00:44 ——– d—–w- c:\documents and settings\MATT\Application Data\Webroot
2009-12-22 00:43 . 2009-12-22 00:43 127 —-a-w- c:\documents and settings\MATT\Local Settings\Application Data\fusioncache.dat
2009-12-22 00:42 . 2009-12-22 00:42 ——– d-sh–w- c:\documents and settings\MATT\IETldCache
2009-12-22 00:21 . 2009-12-22 00:21 ——– d-sh–w- c:\documents and settings\Jacob\PrivacIE
2009-12-21 23:41 . 2009-12-21 23:41 ——– d—–w- c:\documents and settings\Jacob\Application Data\Webroot
2009-12-21 23:41 . 2009-12-21 23:41 128 —-a-w- c:\documents and settings\Jacob\Local Settings\Application Data\fusioncache.dat
2009-12-21 23:40 . 2009-12-21 23:40 ——– d-sh–w- c:\documents and settings\Jacob\IETldCache
2009-12-18 17:47 . 2009-12-18 17:47 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-12-18 16:40 . 2009-12-18 16:40 ——– d—–w- c:\documents and settings\ELIZABETH\Local Settings\Application Data\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 13:14 . 2009-01-16 01:36 ——– d—–w- c:\program files\thinkorswim
2010-01-11 01:34 . 2008-09-09 00:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-09 15:45 . 2009-12-12 00:34 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-07 22:07 . 2009-12-12 00:34 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 22:07 . 2009-12-12 00:34 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 03:11 . 2009-04-29 03:30 ——– d—–w- c:\documents and settings\Jaret\Application Data\Arcsoft
2010-01-05 03:11 . 2009-04-22 03:47 ——– d—–w- c:\program files\Palm
2009-12-31 17:14 . 2009-01-30 03:37 106272 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-31 16:59 . 2009-01-24 00:07 ——– d—–w- c:\program files\MSBuild
2009-12-12 04:05 . 2009-12-12 04:05 ——– d—–w- c:\program files\Opera
2009-12-11 04:42 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\Jaret\Application Data\Webroot
2009-12-11 04:00 . 2009-12-05 19:01 164 —-a-w- c:\windows\install.dat
2009-12-11 03:59 . 2009-12-11 04:02 108880 —-a-w- c:\windows\system32\drivers\pwipf6.sys
2009-12-09 03:15 . 2009-01-23 23:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-08 03:22 . 2009-12-08 03:22 ——– d—–w- c:\documents and settings\ELIZABETH\Application Data\Webroot
2009-12-06 06:11 . 2004-08-10 17:51 ——– d—–w- c:\program files\Common Files\WDMStreaming
2009-12-06 05:21 . 2009-10-10 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\CA
2009-12-05 19:21 . 2009-12-05 19:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2009-12-05 19:10 . 2009-12-05 19:10 ——– d—–w- c:\program files\Ask.com
2009-12-05 19:09 . 2009-12-05 19:09 128 —-a-w- c:\documents and settings\Jaret\Local Settings\Application Data\fusioncache.dat
2009-12-05 19:08 . 2009-12-05 19:08 ——– d—–w- c:\program files\MSSOAP
2009-12-05 19:06 . 2009-12-05 19:06 ——– d—–w- c:\program files\Webroot
2009-12-05 17:22 . 2009-11-03 03:06 ——– d—–w- c:\program files\RegistryFix8
2009-12-05 04:01 . 2006-08-22 02:00 ——– d—–w- c:\program files\Common Files\Adobe
2009-11-25 17:32 . 2006-08-18 02:32 ——– d—–w- c:\program files\Common Files\Real
2009-11-25 17:32 . 2009-11-25 17:32 ——– d—–w- c:\program files\Common Files\xing shared
2009-11-25 17:30 . 2003-02-21 09:42 348160 —-a-w- c:\windows\system32\msvcr71.dll
2009-11-25 17:30 . 2003-03-19 01:14 499712 —-a-w- c:\windows\system32\msvcp71.dll
2009-11-25 17:30 . 2009-11-25 17:30 ——– d—–w- c:\program files\Real
2009-11-21 19:28 . 2008-10-21 20:30 ——– d—–w- c:\program files\Oberon Media
2009-11-21 19:25 . 2006-10-08 23:58 ——– d—–w- c:\program files\PartyGaming.Net
2009-11-21 19:07 . 2008-12-08 03:42 ——– d—–w- c:\program files\OpenOffice.org 3
2009-11-21 19:00 . 2007-05-31 14:19 ——– d—–w- c:\program files\Mobile Video Converter
2009-11-17 14:25 . 2009-01-24 00:07 ——– d—–w- c:\program files\Microsoft Works
2009-11-06 21:19 . 2009-12-05 19:06 1563008 —-a-w- c:\windows\WRSetup.dll
2009-11-06 18:00 . 2009-11-06 18:00 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
2009-11-06 18:00 . 2009-11-06 18:00 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-11-06 18:00 . 2009-11-06 18:00 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2009-11-04 02:28 . 2009-11-04 02:28 23 –sha-w- c:\windows\system32\edacded0.dat
2009-10-29 07:45 . 2004-08-10 17:51 916480 ——w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-10 17:51 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-10 17:51 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 04:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-01-25 00:47 . 2008-10-20 18:25 56 –sh–r- c:\windows\system32\3CEFB3BCE7.sys
2009-01-25 00:47 . 2007-03-07 16:21 2620 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-01-11_01.52.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2010-01-11 01:34 . 2010-01-11 01:34 16384 c:\windows\Temp\Perflib_Perfdata_288.dat
+ 2010-01-11 22:48 . 2010-01-11 22:48 16384 c:\windows\Temp\Perflib_Perfdata_288.dat
+ 2004-08-10 17:51 . 2010-01-11 23:18 72576 c:\windows\system32\perfc009.dat
- 2004-08-10 17:51 . 2010-01-11 01:38 72576 c:\windows\system32\perfc009.dat
- 2006-08-21 21:04 . 2010-01-11 01:33 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-08-21 21:04 . 2010-01-11 22:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-08-21 21:04 . 2010-01-11 22:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-08-21 21:04 . 2010-01-11 01:33 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-08-21 21:04 . 2010-01-11 01:33 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2006-08-21 21:04 . 2010-01-11 22:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-10 17:51 . 2010-01-11 23:18 445370 c:\windows\system32\perfh009.dat
- 2004-08-10 17:51 . 2010-01-11 01:38 445370 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 21:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-06 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-06 77824]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-06 114688]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-25 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-11-06 6515784]

c:\documents and settings\MATT\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Sprint media monitor.lnk - c:\windows\RM.exe [2008-12-8 222552]

c:\documents and settings\LORENZO\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoThumbnailCache"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [11/6/2009 12:00 PM 29808]
R1 pwipf6;pwipf6;c:\windows\system32\drivers\pwipf6.sys [12/10/2009 10:02 PM 108880]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [12/5/2009 1:12 PM 1201640]
S3 WDMStreaming;WDM Streaming Standard Interface Handler Service;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 11:51 AM 14336]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
WDMStreaming
.
Contents of the 'Scheduled Tasks' folder

2010-01-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2010-01-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 02:59]

2010-01-11 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-02-09 21:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
IE: &Google Search
IE: &Search
IE: &Translate English Word
IE: Backward Links
IE: Cached Snapshot of Page
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Similar Pages
IE: Translate Page into English
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
FF - ProfilePath - c:\documents and settings\Jaret\Application Data\Mozilla\Firefox\Profiles\3gaeukj9.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://supertoolbar.ask.com/redirect?client=ff&src=kw&tb=WBR&o=13993&locale=en_US&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Opera\program\plugins\NPSIStub.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 17:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(892)
c:\windows\system32\igfxdev.dll

- - - - - - - > 'winlogon.exe'(284)
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-01-11 18:03:06
ComboFix-quarantined-files.txt 2010-01-12 00:03
ComboFix2.txt 2010-01-11 01:54
ComboFix3.txt 2010-01-10 04:01

Pre-Run: 90,661,330,944 bytes free
Post-Run: 90,727,665,664 bytes free

- - End Of File - - E764EF2F4C131C4FE0295A641F9F3861
Post #9
jwessel22,

Good work, your log looks clean! We have some important cleanup and housekeeping to do now:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 17. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
        Applications and AppletsTrace and Log Files
    • Click OK on Delete Temporary Files Window

      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.
    Click to load external image (Posted Image) Your Adbobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

    Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

    Click to load external image (Posted Image) Uninstall ComboFix
    • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
      Combofix /Uninstall

    Click to load external image (Posted Image)
    Click to load external image (Posted Image) Now to remove most of the tools that we have used in fixing your machine:
    • Make sure you have an Internet Connection.
    • Download OTC to your desktop and run it
    • A list of tool components used in the cleanup of malware will be downloaded.
    • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
    • Click Yes to begin the cleanup process and remove these components, including this application.
    • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
    Click to load external image (Posted Image) Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    Click to load external image (Posted Image) P2P - I see you have P2P software (Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation.
    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall Limewire now. You can do so via Control Panel >> Add or Remove Programs.

    Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
    • Restart any anti-malware programs that we disabled while we were cleaning your machine.
    • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
    • Avoid using P2P programs.
    • Consider running in a limited user account. See this post for more information.
    • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
    Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI