poporacer
Topic Starter
A friend gave me her computer to clean up and here is what I have. She had failed to do any updates to Vista (service pack 1, 2 etc.) she also contracted a few bugs along her way, Vundo and also some fake spyware programs. She knows nothing about computers and tried to fix it herself and then called me. Here is what I have so far. I downloaded ERUNT and ran it, it ran but then there was an error "Unable to create file" and then when you try to continue, you get another error that says, "Error saving file, RegCreatKeyEx:5-Access is denied". I ran MBAM and it discovered several infected files and attempted to clean them. Here is the Log.
Malwarebytes' Anti-Malware 1.44
Database version: 3526
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18865
1/9/2010 7:32:46 AM
mbam-log-2010-01-09 (07-32-46).txt
Scan type: Quick Scan
Objects scanned: 111410
Time elapsed: 18 minute(s), 17 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 40
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\ProgramData\kikepomo\kikepomo.dll (Trojan.Vundo) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\smartshopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ca295d63-514a-4ed0-9b5f-640890f2366b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b0e8c398-dabe-4ce1-b4d9-ed43b64923f5} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{064c57b4-b9ec-425f-b9b3-bceffeea74d9} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0755e4f0-3f92-4a67-ad14-e9f287f76fbc} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{137e6e5e-a205-4657-a49f-1ab865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{137e6e5e-a205-4657-a49f-1ab865787089} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2260d608-c844-435d-90fd-dc16cfa577f2} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2ba1c226-ec1b-4471-a65f-d0688ac6ee3a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2ba1c226-ec1b-4471-a65f-d0688ac6ee3a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2ba1c226-ec1b-4471-a65f-d0688ac6ee3a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2ba1c226-ec1b-4471-a65f-d0688ac6ee3a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bceb373d-a35a-4200-bd43-8586cd9dfae7} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.smrtshprctl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smartshopper.smrtshprctl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{08aa0598-6a23-4364-9bf4-6d5f57f42993} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c7f127df-8877-4e1e-a196-fbbecbc5bc6d} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2615f050-9c18-4267-b711-8e3687dc0145} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cb0d9d8c-535e-4352-ba8f-65c3c8676612} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d7adf7c1-14fb-4110-b2df-187884cac12a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boduyireza (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\smartshopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\smartshopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Program Files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> Quarantined and deleted successfully.
Files Infected:
c:\ProgramData\kikepomo\kikepomo.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Users\Bonit Davenport\AppData\Local\Temp\y.exy (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Bonit Davenport\AppData\Local\Temp\n.exn (Trojan.Vundo) -> Quarantined and deleted successfully.
On rebooting the computer I get an error about unable to rub kikepomo.dll I am sure this is because of an autorun entry that we need to fix down the road.
I tried to run the GMER rootkit scanner but when it ran it froze up or a message pooped up stating that the program stopped working.
Then I ran the DDS file but before I ran it, I attempted to disable the Windows Defender according to the instructions. When I went to Start > Programs > Windows Defender •Click on Tools & Settings > Options.
•Under Real-time protection options, uncheck the "Real-time protection" check box.
There was no option box to check or unchec for Real-time protection. And when I went to the control panel and was told to remove the Administrator options, there was not that option.
Here is the log it created:
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 7:37:18.01 on Sun 01/10/2010
Internet Explorer: 8.0.6001.18865
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.1048 [GMT -8:00]
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\LEXBCES.EXE
C:\Windows\System32\LEXPPS.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Nova Development\Scrapbook Factory Deluxe 4.0\ReminderApp.exe
C:\Program Files\ATT-SST\McciTrayApp.exe
C:\Program Files\AT&T\Internet Security Wizard\ISW.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\honestech One Touch DVD\Receiver.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\mcbuilder.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Bonit Davenport\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.att.net/
uSearch Page =
uSearch Bar =
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn2\yt.dll
uURLSearchHooks: N/A: {9cb65206-89c4-402c-ba80-02d8c59f9b1d} - c:\program files\asktbar\srchastt\1.bin\A5SRCHAS.DLL
BHO: rsion - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: ` P - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn2\yt.dll
BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.0\NppBho.dll
BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
BHO: Ask Search Assistant BHO: {9cb65201-89c4-402c-ba80-02d8c59f9b1d} - c:\program files\asktbar\srchastt\1.bin\A5SRCHAS.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
BHO: Ask Toolbar BHO: {fe063db1-4ec0-403e-8dd8-394c54984b2c} - c:\program files\asktbar\bar\1.bin\ASKTBAR.DLL
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn2\yt.dll
TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.0\UIBHO.dll
TB: Ask Toolbar: {fe063db9-4ec0-403e-8dd8-394c54984b2c} - c:\program files\asktbar\bar\1.bin\ASKTBAR.DLL
TB: Webshots Toolbar: {c17590d2-ecb4-4b15-8820-f58798dcc118} - c:\program files\webshots\WSToolbar4IE.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [UpdateFlow.ATT-SST] c:\program files\att-sst\mccibrowser.exe -appkey=att-sst -url=file://c:\program files\att-sst\offlineupdate\redirector.htm
uRun: [fayopipef] Rundll32.exe "c:\progra~2\kikepomo\kikepomo.dll",a
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [CCUTRAYICON] FactoryMode
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [osCheck] "c:\program files\norton internet security\osCheck.exe"
mRun: []
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [ReminderApp] c:\program files\nova development\scrapbook factory deluxe 4.0\ReminderApp.exe
mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe"
mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\programdata\scansoft\paperport\11\config\ereg\Ereg.ini"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\bonitd~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\2wires~1.lnk - c:\program files\2wire\LaunchSetupWiz.exe
StartupFolder: c:\users\bonitd~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\users\bonitd~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\users\bonitd~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\audibl~1.lnk - c:\program files\audible\bin\AudibleDownloadHelper.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\honest~1.lnk - c:\program files\honestech one touch dvd\Receiver.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Webshots Photo Search - c:\program files\webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\programs\partygaming\partypoker\RunApp.exe
IE: {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - c:\programs\partygaming\partybingo\RunBingo.exe
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
Trusted Zone: motive.com\patttbc.att
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxps://config.skillcheck.com/onlinetesting/icaclients/win32/7.0.00/onlinetesting.cab
DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://www.costcophotocenter.com/upload/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {924C1588-90C3-4910-B6CA-D57A1C0418FE} - hxxp://bookmarks.yahoo.com/YbConvFav.CAB
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://www.costcophotocenter.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
============= SERVICES / DRIVERS ===============
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20070409.003\IDSvix86.sys [2007-4-10 212280]
R2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896]
R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2009-3-19 391168]
S2 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696]
S3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2006-10-24 37008]
=============== Created Last 30 ================
2010-01-09 08:40 –d—– c:\windows\system32\vi-VN
2010-01-09 08:40 –d—– c:\windows\system32\eu-ES
2010-01-09 08:40 –d—– c:\windows\system32\ca-ES
2010-01-09 08:39 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-01-09 08:39 0 a—h— c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-09 07:27 –d—– c:\windows\system32\EventProviders
2010-01-09 07:25 69,632 a——- c:\windows\system32\PNPXAssoc.dll
2010-01-09 07:24 705,536 a——- c:\windows\system32\SmiEngine.dll
2010-01-09 07:23 613,888 a——- c:\windows\system32\MSMPEG2VDEC.DLL
2010-01-09 07:22 2,092,544 a——- c:\windows\system32\dfsr.exe
2010-01-09 07:07 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-09 07:07 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-09 07:07 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-08 21:54 18,904 a——- c:\windows\system32\StructuredQuerySchemaTrivial.bin
2010-01-08 21:53 11,967,524 a——- c:\windows\system32\korwbrkr.lex
2010-01-08 21:39 –d—– c:\programdata\Office Genuine Advantage
2010-01-08 21:38 32,821 a——- c:\programdata\nvModes.dat
2010-01-08 21:38 32,821 a——- c:\progra~2\nvModes.dat
2010-01-08 16:12 –d—– C:\PerfLogs
2010-01-08 15:19 –d—– c:\programdata\lakumuso
2010-01-08 15:19 –d—– c:\programdata\kikepomo
2010-01-08 15:19 –d—– c:\programdata\hikemavi
2010-01-08 15:19 –d—– c:\progra~2\lakumuso
2010-01-08 15:19 –d—– c:\progra~2\kikepomo
2010-01-08 15:19 –d—– c:\progra~2\hikemavi
2010-01-06 17:50 –d—– c:\programdata\roredopu
2010-01-06 17:50 –d—– c:\progra~2\roredopu
2010-01-06 17:50 –d—– c:\programdata\fidamufa
2010-01-06 17:50 –d—– c:\progra~2\fidamufa
2010-01-06 05:49 –d—– c:\programdata\runivuji
2010-01-06 05:49 –d—– c:\programdata\dabehuza
2010-01-06 05:49 –d—– c:\progra~2\runivuji
2010-01-06 05:49 –d—– c:\progra~2\dabehuza
2010-01-05 15:06 –d—– c:\programdata\rumuluye
2010-01-05 15:06 –d—– c:\programdata\hototudu
2010-01-05 15:06 –d—– c:\programdata\fihikulo
2010-01-05 15:06 –d—– c:\progra~2\rumuluye
2010-01-05 15:06 –d—– c:\progra~2\hototudu
2010-01-05 15:06 –d—– c:\progra~2\fihikulo
2010-01-05 03:06 –d—– c:\programdata\pipayonu
2010-01-05 03:06 –d—– c:\programdata\hejebari
2010-01-05 03:06 –d—– c:\programdata\gorirohu
2010-01-05 03:06 –d—– c:\progra~2\pipayonu
2010-01-05 03:06 –d—– c:\progra~2\hejebari
2010-01-05 03:06 –d—– c:\progra~2\gorirohu
2010-01-04 15:06 –d—– c:\programdata\zedafehe
2010-01-04 15:06 –d—– c:\programdata\woporuzo
2010-01-04 15:06 –d—– c:\programdata\pewutuga
2010-01-04 15:06 –d—– c:\progra~2\zedafehe
2010-01-04 15:06 –d—– c:\progra~2\woporuzo
2010-01-04 15:06 –d—– c:\progra~2\pewutuga
2010-01-03 04:39 –d—– c:\programdata\lelafugi
2010-01-03 04:39 –d—– c:\programdata\kotihuya
2010-01-03 04:39 –d—– c:\progra~2\lelafugi
2010-01-03 04:39 –d—– c:\progra~2\kotihuya
2010-01-02 16:39 –d—– c:\programdata\lagipale
2010-01-02 16:39 –d—– c:\programdata\garafufe
2010-01-02 16:39 –d—– c:\progra~2\lagipale
2010-01-02 16:39 –d—– c:\progra~2\garafufe
2010-01-02 04:39 –d—– c:\programdata\zilabivi
2010-01-02 04:39 –d—– c:\programdata\yabepegi
2010-01-02 04:39 –d—– c:\progra~2\zilabivi
2010-01-02 04:39 –d—– c:\progra~2\yabepegi
2010-01-01 16:38 –d—– c:\programdata\zuwivavu
2010-01-01 16:38 –d—– c:\programdata\yazewigo
2010-01-01 16:38 –d—– c:\progra~2\zuwivavu
2010-01-01 16:38 –d—– c:\progra~2\yazewigo
2009-12-31 15:34 –d—– c:\programdata\kudegovu
2009-12-31 15:34 –d—– c:\programdata\dibawumi
2009-12-31 15:34 –d—– c:\progra~2\kudegovu
2009-12-31 15:34 –d—– c:\progra~2\dibawumi
2009-12-30 12:07 –d—– c:\programdata\jaharati
2009-12-30 12:07 –d—– c:\programdata\herutoho
2009-12-30 12:07 –d—– c:\programdata\baliteta
2009-12-30 12:07 –d—– c:\progra~2\jaharati
2009-12-30 12:07 –d—– c:\progra~2\herutoho
2009-12-30 12:07 –d—– c:\progra~2\baliteta
2009-12-30 12:06 –d—– c:\programdata\kataliwo
2009-12-30 12:06 –d—– c:\programdata\dararudi
2009-12-30 12:06 –d—– c:\programdata\dajidomu
2009-12-30 12:06 –d—– c:\progra~2\kataliwo
2009-12-30 12:06 –d—– c:\progra~2\dararudi
2009-12-30 12:06 –d—– c:\progra~2\dajidomu
2009-12-29 17:56 –d—– c:\users\bonitd~1\appdata\roaming\Malwarebytes
2009-12-29 17:56 –d—– c:\programdata\Malwarebytes
2009-12-29 17:56 –d—– c:\progra~2\Malwarebytes
2009-12-29 12:47 –d—– c:\programdata\rehotiza
2009-12-29 12:47 –d—– c:\programdata\lanikuwo
2009-12-29 12:47 –d—– c:\progra~2\rehotiza
2009-12-29 12:47 –d—– c:\progra~2\lanikuwo
2009-12-29 00:47 –d—– c:\programdata\motatere
2009-12-29 00:47 –d—– c:\programdata\mijikive
2009-12-29 00:47 –d—– c:\progra~2\motatere
2009-12-29 00:47 –d—– c:\progra~2\mijikive
2009-12-28 17:18 –d—– c:\program files\ATT-RC
2009-12-28 12:47 –d—– c:\programdata\raritazu
2009-12-28 12:47 –d—– c:\programdata\dedufaro
2009-12-28 12:47 –d—– c:\progra~2\raritazu
2009-12-28 12:47 –d—– c:\progra~2\dedufaro
2009-12-28 00:46 –d—– c:\programdata\yizimife
2009-12-28 00:46 –d—– c:\programdata\gevimoji
2009-12-28 00:46 –d—– c:\progra~2\yizimife
2009-12-28 00:46 –d—– c:\progra~2\gevimoji
2009-12-27 20:37 –d—– c:\users\bonitd~1\appdata\roaming\HpUpdate
2009-12-27 20:37 –d—– c:\windows\Hewlett-Packard
2009-12-27 12:46 –d—– c:\programdata\watitatu
2009-12-27 12:46 –d—– c:\programdata\nunoluyi
2009-12-27 12:46 –d—– c:\progra~2\watitatu
2009-12-27 12:46 –d—– c:\progra~2\nunoluyi
2009-12-27 00:46 –d—– c:\programdata\gagavosu
2009-12-27 00:46 –d—– c:\programdata\bigasunu
2009-12-27 00:46 –d—– c:\progra~2\gagavosu
2009-12-27 00:46 –d—– c:\progra~2\bigasunu
2009-12-26 12:46 –d—– c:\programdata\vibinuze
2009-12-26 12:46 –d—– c:\programdata\mobeteda
2009-12-26 12:46 –d—– c:\programdata\ludimeda
2009-12-26 12:46 –d—– c:\progra~2\vibinuze
2009-12-26 12:46 –d—– c:\progra~2\mobeteda
2009-12-26 12:46 –d—– c:\progra~2\ludimeda
2009-12-26 00:46 –d—– c:\programdata\vubebiye
2009-12-26 00:46 –d—– c:\programdata\toponaku
2009-12-26 00:46 –d—– c:\programdata\nilezisu
2009-12-26 00:46 –d—– c:\progra~2\vubebiye
2009-12-26 00:46 –d—– c:\progra~2\toponaku
2009-12-26 00:46 –d—– c:\progra~2\nilezisu
2009-12-25 12:46 –d—– c:\programdata\nisisaji
2009-12-25 12:46 –d—– c:\programdata\mileyige
2009-12-25 12:46 –d—– c:\programdata\hilijizi
2009-12-25 12:46 –d—– c:\progra~2\nisisaji
2009-12-25 12:46 –d—– c:\progra~2\mileyige
2009-12-25 12:46 –d—– c:\progra~2\hilijizi
2009-12-25 12:46 –d—– c:\programdata\yubiyufo
2009-12-25 12:46 –d—– c:\programdata\voluguhe
2009-12-25 12:46 –d—– c:\programdata\sohotuwa
2009-12-25 12:46 –d—– c:\programdata\nobibipo
2009-12-25 12:46 –d—– c:\progra~2\yubiyufo
2009-12-25 12:46 –d—– c:\progra~2\voluguhe
2009-12-25 12:46 –d—– c:\progra~2\sohotuwa
2009-12-25 12:46 –d—– c:\progra~2\nobibipo
2009-12-25 00:45 –d—– c:\programdata\nufuyinu
2009-12-25 00:45 –d—– c:\programdata\makiyuwu
2009-12-25 00:45 –d—– c:\progra~2\nufuyinu
2009-12-25 00:45 –d—– c:\progra~2\makiyuwu
2009-12-25 00:40 –d—– c:\programdata\zefovusa
2009-12-25 00:40 –d—– c:\programdata\gayigasi
2009-12-25 00:40 –d—– c:\programdata\fakevife
2009-12-25 00:40 –d—– c:\progra~2\zefovusa
2009-12-25 00:40 –d—– c:\progra~2\gayigasi
2009-12-25 00:40 –d—– c:\progra~2\fakevife
==================== Find3M ====================
2010-01-09 08:47 143,360 a——- c:\windows\inf\infstrng.dat
2010-01-09 08:47 86,016 a——- c:\windows\inf\infstor.dat
2010-01-09 08:47 51,200 a——- c:\windows\inf\infpub.dat
2010-01-09 08:40 665,600 a——- c:\windows\inf\drvindex.dat
2010-01-08 16:23 174 a–sh— c:\program files\desktop.ini
2010-01-08 15:53 101,888 a——- c:\windows\system32\ifxcardm.dll
2010-01-08 15:53 82,432 a——- c:\windows\system32\axaltocm.dll
2010-01-05 15:57 10,602 a——- c:\users\bonitd~1\appdata\roaming\wklnhst.dat
2009-11-20 22:40 916,480 a——- c:\windows\system32\wininet.dll
2009-11-20 22:34 109,056 a——- c:\windows\system32\iesysprep.dll
2009-11-20 22:34 71,680 a——- c:\windows\system32\iesetup.dll
2009-11-20 20:59 133,632 a——- c:\windows\system32\ieUnatt.exe
2009-11-09 04:31 24,064 a——- c:\windows\system32\nshhttp.dll
2009-11-09 04:30 30,720 a——- c:\windows\system32\httpapi.dll
2009-11-02 20:42 195,456 ——– c:\windows\system32\MpSigStub.exe
2009-10-29 01:17 2,048 a——- c:\windows\system32\tzres.dll
2006-11-02 04:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 04:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 04:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 04:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 01:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 01:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 01:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 01:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 7:42:02.03 ===============
I wasn't able to post the GMER log as it didn't run.
Thanks for your assistance!
Rick
:cc,6d,05,78,4b,91,ca,01
So I went back and installed AVG (for about the 10th time) and this time I said to skip the uninstall of Norton (against ComboFix's advice) and I was able to install and run AVG. I did a complete scan and it found one issue, Toolband.toolband.obj. I told it to remove the object, and it couldn't then it asked if I wanted to try again and I said yes, and it seemed to quarantine it. The computere seems to be running better but there is still the issue of the "locked" items in the explorer.