What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] search engine redirector

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I want to thank you in advance for your time and effort. Within the past several days, my computer has been infected with what I think is the redirector virus. When I click on a link in a search engine (google) I am taken to a non related site and am not able to find any related results. Any help you can give me will be appreciated, and I will follow your directions as closely as possible. Please note the two dss.scr reports below: Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 9/27/2005 10:18:26 PM System Uptime: 5/23/2010 12:56:00 PM (2 hours ago) Motherboard: MICRO-STAR INTERNATIONAL CO., LTD | | MS-7142 Processor: AMD Athlon™ 64 Processor 3000+ | Socket 754 | 1999/200mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 149 GiB total, 95.434 GiB free. D: is FIXED (NTFS) - 114 GiB total, 103.889 GiB free. E: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Universal Serial Bus (USB) Controller Device ID: PCI\VEN_1106&DEV;_3104&SUBSYS;_71421462&REV;_86\3&13C0B0C5&0&84 Manufacturer: Name: Universal Serial Bus (USB) Controller PNP Device ID: PCI\VEN_1106&DEV;_3104&SUBSYS;_71421462&REV;_86\3&13C0B0C5&0&84 Service: ==== System Restore Points =================== RP1123: 2/22/2010 5:44:55 PM - System Checkpoint RP1124: 2/23/2010 9:57:26 AM - Installed Java™ 6 Update 18 RP1125: 2/24/2010 1:50:52 PM - System Checkpoint RP1126: 2/25/2010 10:10:39 PM - System Checkpoint RP1127: 2/26/2010 10:52:00 PM - System Checkpoint RP1128: 2/28/2010 5:15:15 PM - System Checkpoint RP1129: 3/1/2010 6:16:45 PM - System Checkpoint RP1130: 3/3/2010 3:51:37 PM - System Checkpoint RP1131: 3/4/2010 6:36:03 PM - System Checkpoint RP1132: 3/6/2010 7:14:44 PM - System Checkpoint RP1133: 3/8/2010 5:38:53 PM - System Checkpoint RP1134: 3/9/2010 8:08:40 PM - System Checkpoint RP1135: 3/10/2010 8:45:08 PM - System Checkpoint RP1136: 3/11/2010 10:41:21 PM - System Checkpoint RP1137: 3/13/2010 8:54:16 PM - System Checkpoint RP1138: 3/16/2010 5:53:19 PM - System Checkpoint RP1139: 3/17/2010 9:23:33 PM - System Checkpoint RP1140: 3/19/2010 7:31:50 PM - System Checkpoint RP1141: 3/20/2010 8:57:28 PM - System Checkpoint RP1142: 3/22/2010 4:54:52 PM - System Checkpoint RP1143: 3/24/2010 5:51:12 PM - System Checkpoint RP1144: 3/27/2010 6:25:06 AM - System Checkpoint RP1145: 3/28/2010 2:16:31 PM - System Checkpoint RP1146: 3/29/2010 7:51:53 PM - System Checkpoint RP1147: 3/31/2010 5:47:42 PM - System Checkpoint RP1148: 4/1/2010 6:34:42 PM - System Checkpoint RP1149: 4/2/2010 6:44:59 PM - System Checkpoint RP1150: 4/3/2010 11:14:23 PM - System Checkpoint RP1151: 4/6/2010 6:06:44 AM - System Checkpoint RP1152: 4/8/2010 7:01:14 PM - System Checkpoint RP1153: 4/10/2010 9:02:42 PM - System Checkpoint RP1154: 4/12/2010 4:14:59 PM - System Checkpoint RP1155: 4/13/2010 7:31:45 PM - System Checkpoint RP1156: 4/14/2010 9:50:51 PM - System Checkpoint RP1157: 4/16/2010 5:47:02 PM - System Checkpoint RP1158: 4/19/2010 7:39:12 PM - System Checkpoint RP1159: 4/20/2010 7:47:33 PM - System Checkpoint RP1160: 4/21/2010 8:11:56 PM - System Checkpoint RP1161: 4/22/2010 9:43:18 PM - System Checkpoint RP1162: 4/25/2010 9:31:44 PM - System Checkpoint RP1163: 4/27/2010 11:28:02 AM - System Checkpoint RP1164: 4/28/2010 5:39:35 PM - System Checkpoint RP1165: 4/29/2010 8:17:15 PM - System Checkpoint RP1166: 5/1/2010 6:27:29 AM - System Checkpoint RP1167: 5/2/2010 1:32:58 PM - System Checkpoint RP1168: 5/3/2010 5:49:17 PM - System Checkpoint RP1169: 5/4/2010 9:54:06 PM - System Checkpoint RP1170: 5/6/2010 8:48:04 AM - System Checkpoint RP1171: 5/7/2010 8:49:11 PM - System Checkpoint RP1172: 5/9/2010 5:31:04 PM - System Checkpoint RP1173: 5/10/2010 6:24:15 PM - System Checkpoint RP1174: 5/11/2010 8:29:59 PM - System Checkpoint RP1175: 5/12/2010 11:15:12 PM - System Checkpoint RP1176: 5/14/2010 4:16:16 PM - System Checkpoint RP1177: 5/15/2010 7:28:21 PM - Software Distribution Service 3.0 RP1178: 5/17/2010 7:47:30 PM - System Checkpoint RP1179: 5/19/2010 6:16:43 PM - System Checkpoint RP1180: 5/20/2010 6:54:20 PM - System Checkpoint RP1181: 5/22/2010 10:10:06 AM - System Checkpoint ==== Installed Programs ====================== 2 Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.3.2 American Civil War Gettysburg Anti-Spyware AnyDVD ArcSoft PhotoImpression 5 ArcSoft Software Suite Authentium BitDefender Total Security 2009 CloneCD CloneDVD2 CommandTRADE FX CorelDRAW Graphics Suite X4 CorelDRAW Graphics Suite X4 - Capture CorelDRAW Graphics Suite X4 - Content CorelDRAW Graphics Suite X4 - Draw CorelDRAW Graphics Suite X4 - Filters CorelDRAW Graphics Suite X4 - FontNav CorelDRAW Graphics SUite X4 - ICA CorelDRAW Graphics Suite X4 - IPM CorelDRAW Graphics Suite X4 - Lang BR CorelDRAW Graphics Suite X4 - Lang EN CorelDRAW Graphics Suite X4 - Lang ES CorelDRAW Graphics Suite X4 - Lang FR CorelDRAW Graphics Suite X4 - PP CorelDRAW Graphics Suite X4 - VBA CorelDRAW® Graphics Suite X4 CorelDRAW® Graphics Suite X4 - Windows Shell Extension DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0 East-Tec Eraser 2008 Version 8.9 EPSON CX 3800 Guide EPSON Printer Software EPSON Scan Eraser Finale NotePad 2006 GlobalTec Streaming News Google Earth Google Update Helper Google Updater GoToMeeting 4.0.0.320 Hotfix for Windows XP (KB926239) InterActual Player J2SE Runtime Environment 5.0 Update 7 Java 2 Runtime Environment Standard Edition v1.3.0_01 Java Auto Updater Java™ 6 Update 18 Malwarebytes' Anti-Malware MBT Navigator Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Office 2000 Premium Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Web Publishing Wizard 1.52 Move Media Player Mozilla Firefox (3.6.3) MSN Music Assistant MSXML 6.0 Parser Nikon Message Center PictureProject PrintMaster® Premier 8.0 QuickTime Registerdllsetup Security Update for CAPICOM (KB931906) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB912919) Serif DrawPlus 3.0 Spybot - Search & Destroy Spybot - Search & Destroy 1.4 Tracks Eraser Pro v6.0 Update for Windows XP (KB898461) Update for Windows XP (KB910437) Update for Windows XP (KB933360) Verizon PC Security Checkup VIA Audio Driver Setup Program Visual Basic for Applications ® Core Visual Basic for Applications ® Core - English WebEx WebFldrs XP Windows Genuine Advantage v1.3.0254.0 Windows Genuine Advantage Validation Tool (KB892130) Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WizeFeed 2.1 Wizetrade® FOREX ==== End Of File =========================== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 14:11:33.53 on Sun 05/23/2010 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.354 [GMT -7:00] AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB} FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Eraser\eraser.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\East-Tec Eraser 2008\etRiskMon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\Documents and Settings\DMG\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.foxnews.com uWindow Title = uDefault_Page_URL = hxxp://www.foxnews.com mDefault_Page_URL = hxxp://www.foxnews.com mStart Page = hxxp://www.foxnews.com mWindow Title = uInternet Connection Wizard,ShellNext = iexplore BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2009\IEToolbar.dll uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Eraser] c:\program files\eraser\eraser.exe -hide uRun: [Eraser RiskMonitor] "c:\program files\east-tec eraser 2008\launch.exe" "c:\program files\east-tec eraser 2008\etRiskMon.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2009\bdagent.exe" mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2009\IEShow.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: vzTCPConfig - hxxps://www.verizon.net/WhatsNext/CheckMyPc/vzTCPConfig.CAB DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1204568885234 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1204568839578 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://commandtrade.webex.com/client/T26L/training/ieatgpc.cab DPF: {E19F9330-3110-11d4-991C-005004D3B3DB} - hxxp://java.sun.com/products/plugin/1.3.0_01/jinstall-130_01-win.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\dmg\applic~1\mozilla\firefox\profiles\azy2tjyk.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com FF - plugin: c:\documents and settings\dmg\application data\move networks\plugins\npqmp071701000002.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R2 BDVEDISK;BDVEDISK;c:\program files\bitdefender\bitdefender 2009\BDVEDISK.sys [2008-10-6 82696] R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2008-9-18 111112] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2009-2-3 104456] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-21 135664] S3 Arrakis3;BitDefender Arrakis Server;c:\program files\common files\bitdefender\bitdefender arrakis server\bin\Arrakis3.exe [2008-7-17 118784] S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?] =============== Created Last 30 ================ 2010-05-22 22:02 –d—– c:\program files\TeaTimer (Spybot - Search & Destroy) 2010-05-22 22:02 –d—– c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2010-05-22 22:01 –d—– c:\program files\SDHelper (Spybot - Search & Destroy) 2010-05-12 18:13 54,156 a—h— c:\windows\QTFont.qfn 2010-05-12 18:13 1,409 a——- c:\windows\QTFont.for ==================== Find3M ==================== 2010-05-22 22:35 81,984 a——- c:\windows\system32\bdod.bin 2010-05-22 15:38 1,744 a——- c:\windows\system32\d3d9caps.dat 2010-05-22 15:38 1,632 a——- c:\windows\system32\d3d8caps.dat 2010-04-30 20:42 2,209 a——- c:\windows\EntPack.dat 2010-04-29 15:39 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 15:39 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-02-23 10:57 411,368 a——- c:\windows\system32\deploytk.dll 2008-12-11 09:21 87,608 a——- c:\docume~1\dmg\applic~1\inst.exe 2008-12-11 09:21 47,360 a——- c:\docume~1\dmg\applic~1\pcouffin.sys 2008-11-25 08:50 60,744 a——- c:\documents and settings\dmg\g2mdlhlpx.exe ============= FINISH: 14:12:46.26 ===============
Post #2
Hi,

Please do the following:


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Hi again, I have encountered a couple of problems. First I had trouble downloading and running GMER. Secondly, After beginning to start the scan my computer rebooted itself twice before I could start the scan and three times during the scanning process. The reboot events occurred at different times through the scan. I did notice that the program did not freeze on 2 of the occasions because i was watching when it happened. The GMER scan process indicator at the bottom was moving through my files. Thank you again for the assistance and I await your response. Sailplane
Post #4
Please try this scanner instead:

Please download this file, and save it to your Desktop. Once you have downloaded it, save and close all other programs and run it by double-clicking on the file named "RootRepeal.exe".

Once the main window shows up, please click on the "Report" button on the bottom of the window. Next, please click the "Scan" button.

Another window will pop up asking you to select what to include in the scan. Please uncheck everything except for the "Stealth Code" checkbox, and then click OK.

Once the program has finished scanning, the results will appear. Click on the "Save Report" button, and save the report to your desktop.

Finally, please open this report with Notepad, and post it here.
Post #5
Thanks, Much easier and faster. ROOTREPEAL © AD, 2007-2010 ================================================== Report Save Time: 2010/05/23 22:33 Program Version: Version 2.0.0.0 Windows Version: Windows XP SP2 ================================================== STEALTH CODE ——————- System 0x8a05faea - Hidden Code System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_CLEANUP] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_CLOSE] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_CREATE] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_CREATE_MAILSLOT] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_CREATE_NAMED_PIPE] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_DEVICE_CHANGE] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_DEVICE_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_DIRECTORY_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_FILE_SYSTEM_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_FLUSH_BUFFERS] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_LOCK_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_POWER] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_QUERY_EA] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_QUERY_INFORMATION] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_QUERY_QUOTA] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_QUERY_SECURITY] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_QUERY_VOLUME_INFORMATION] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_READ] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SCSI] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SET_EA] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SET_INFORMATION] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SET_SECURITY] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SET_VOLUME_INFORMATION] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SHUTDOWN] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_SYSTEM_CONTROL] System 0x8a05fd01 - Hidden Code [Driver: , IRP: IRP_MJ_WRITE] System 0xba414035 - Modified Entry Point [Driver: Mouclass, Other Val: 0xba414814]
Post #6
Hi,

Please do the following:


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #7
Thanks,
Here is the combofix report.
Sailplane






ComboFix 10-05-24.03 - DMG 05/24/2010 20:13:52.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.505 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\DMG\Application Data\inst.exe
c:\documents and settings\DMG\g2mdlhlpx.exe
c:\windows\system32\logs
c:\windows\twain_16.dll

.
((((((((((((((((((((((((( Files Created from 2010-04-25 to 2010-05-25 )))))))))))))))))))))))))))))))
.

2010-05-23 05:02 . 2010-05-23 05:02 ——– d—–w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-05-23 05:02 . 2010-05-23 05:02 ——– d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-05-23 05:01 . 2010-05-23 05:01 ——– d—–w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-05-22 17:19 . 2010-05-22 17:19 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2010-05-20 21:32 . 2010-05-20 21:32 61440 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6fbadb0c-n\decora-sse.dll
2010-05-20 21:32 . 2010-05-20 21:32 12800 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6fbadb0c-n\decora-d3d.dll
2010-05-20 21:32 . 2010-05-20 21:32 503808 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\msvcp71.dll
2010-05-20 21:32 . 2010-05-20 21:32 499712 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\jmc.dll
2010-05-20 21:32 . 2010-05-20 21:32 348160 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\msvcr71.dll
2010-05-20 01:23 . 2010-05-20 01:23 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-25 03:09 . 2005-11-26 02:56 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-25 03:09 . 2005-11-26 02:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-25 01:52 . 2008-10-28 05:39 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-25 01:36 . 2009-03-30 17:08 81984 —-a-w- c:\windows\system32\bdod.bin
2010-05-25 01:36 . 2006-02-08 22:15 ——– d—–w- c:\program files\Eraser
2010-05-25 01:28 . 2008-10-26 23:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-24 04:03 . 2007-03-31 06:25 1744 —-a-w- c:\windows\system32\d3d9caps.dat
2010-05-24 04:03 . 2005-09-30 00:32 1632 —-a-w- c:\windows\system32\d3d8caps.dat
2010-05-23 05:06 . 2009-08-16 06:33 ——– d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-05-23 02:03 . 2008-10-27 00:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-20 21:32 . 2010-05-20 20:46 1744 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d9caps.tmp
2010-05-20 20:46 . 2010-05-20 20:46 1632 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d8caps.tmp
2010-05-20 20:25 . 2009-03-30 23:14 1744 —-a-w- c:\documents and settings\kids\Local Settings\Application Data\d3d9caps.tmp
2010-05-16 02:57 . 2008-11-17 18:23 ——– d—–w- c:\program files\Microsoft Silverlight
2010-05-01 03:42 . 2005-12-31 08:39 2209 —-a-w- c:\windows\EntPack.dat
2010-04-29 22:39 . 2008-10-27 00:13 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2008-10-27 00:13 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-10 21:03 . 2008-12-11 16:21 ——– d—–w- c:\documents and settings\DMG\Application Data\Vso
2010-04-10 20:15 . 2009-06-20 23:18 ——– d—–w- c:\documents and settings\kids\Application Data\Vso
2010-03-11 14:28 . 2010-03-11 14:28 61440 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58fc4c41-n\decora-sse.dll
2010-03-11 14:28 . 2010-03-11 14:28 503808 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\msvcp71.dll
2010-03-11 14:28 . 2010-03-11 14:28 499712 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\jmc.dll
2010-03-11 14:28 . 2010-03-11 14:28 348160 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\msvcr71.dll
2010-03-11 14:28 . 2010-03-11 14:28 12800 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58fc4c41-n\decora-d3d.dll
2009-11-13 03:58 . 2008-10-31 00:34 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
2008-08-18 18:21 . 2008-08-18 18:21 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-08-18 18:21 . 2008-08-18 18:21 125848 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-09-23 19:32 . 2008-09-23 19:32 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\eraser.exe" [2003-07-25 536576]
"Eraser RiskMonitor"="c:\program files\East-Tec Eraser 2008\Launch.exe" [2008-03-22 18536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-01-05 98304]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-13 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

c:\documents and settings\kids\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^DMG^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\DMG\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2006-12-27 22:36 502687 —-a-w- c:\program files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2006-09-28 19:21 57344 —-a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3800 Series]
2005-02-08 03:00 98304 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIACA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2003-07-25 18:15 536576 —-a-w- c:\program files\Eraser\eraser.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-04 07:56 1667584 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tracks Eraser Pro]
2006-12-16 19:02 1298432 —-a-w- c:\program files\Acesoft\Tracks Eraser Pro\te.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [10/6/2008 5:16 PM 82696]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09 AM 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2/3/2009 5:03 PM 104456]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/21/2009 4:17 PM 135664]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [7/17/2008 12:06 PM 118784]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2010-05-25 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-26 01:12]

2010-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore1caef2f438e3518.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 23:16]

2010-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 23:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com
mStart Page = hxxp://www.foxnews.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: vzTCPConfig - hxxps://www.verizon.net/WhatsNext/CheckMyPc/vzTCPConfig.CAB
FF - ProfilePath - c:\documents and settings\DMG\Application Data\Mozilla\Firefox\Profiles\azy2tjyk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com
FF - plugin: c:\documents and settings\DMG\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-GhostStartTrayApp - c:\program files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
MSConfigStartUp-NeroFilterCheck - c:\windows\System32\NeroCheck.exe
AddRemove-C0MM4NDT-L00K-FXFX-H3R3-UN1NST4LLTH3_is1 - c:\program files\GlobalTec Solutions
AddRemove-F0RX34SY-L00K-1T1Z-H3R3-UN1NST4LLTH3_is1 - c:\program files\GlobalTec Solutions
AddRemove-W1Z3F33D-CD0C-4AC4-86B4-X11E5511AA18_is1 - c:\program files\GlobalTec Solutions



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-24 20:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-05-24 20:26:33
ComboFix-quarantined-files.txt 2010-05-25 03:26

Pre-Run: 102,367,735,808 bytes free
Post-Run: 104,018,509,824 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - C661429D1B8DF2822328E137D77130EA
Post #8 last edited
Hi,

Please do the following:
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

TDL::
c:\windows\system32\drivers\Mouclass.sys

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #9
ComboFix 10-05-25.02 - DMG 05/26/2010 0:10.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.903 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\DMG\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
.

((((((((((((((((((((((((( Files Created from 2010-04-26 to 2010-05-26 )))))))))))))))))))))))))))))))
.

2010-05-26 00:51 . 2010-05-26 00:51 348160 —-a-w- c:\documents and settings\DMG\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-42447d6e-n\msvcr71.dll
2010-05-26 00:51 . 2010-05-26 00:51 503808 —-a-w- c:\documents and settings\DMG\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-42447d6e-n\msvcp71.dll
2010-05-26 00:51 . 2010-05-26 00:51 61440 —-a-w- c:\documents and settings\DMG\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-38db9bba-n\decora-sse.dll
2010-05-26 00:51 . 2010-05-26 00:51 499712 —-a-w- c:\documents and settings\DMG\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-42447d6e-n\jmc.dll
2010-05-26 00:51 . 2010-05-26 00:51 12800 —-a-w- c:\documents and settings\DMG\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-38db9bba-n\decora-d3d.dll
2010-05-23 05:02 . 2010-05-23 05:02 ——– d—–w- c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-05-23 05:02 . 2010-05-23 05:02 ——– d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-05-23 05:01 . 2010-05-23 05:01 ——– d—–w- c:\program files\SDHelper (Spybot - Search & Destroy)
2010-05-22 17:19 . 2010-05-22 17:19 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2010-05-20 21:32 . 2010-05-20 21:32 61440 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6fbadb0c-n\decora-sse.dll
2010-05-20 21:32 . 2010-05-20 21:32 12800 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6fbadb0c-n\decora-d3d.dll
2010-05-20 21:32 . 2010-05-20 21:32 503808 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\msvcp71.dll
2010-05-20 21:32 . 2010-05-20 21:32 499712 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\jmc.dll
2010-05-20 21:32 . 2010-05-20 21:32 348160 —-a-w- c:\documents and settings\Guest\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3732c757-n\msvcr71.dll
2010-05-20 01:23 . 2010-05-20 01:23 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 02:29 . 2008-10-26 23:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-26 00:50 . 2007-03-31 06:25 1744 —-a-w- c:\windows\system32\d3d9caps.dat
2010-05-26 00:46 . 2008-10-28 05:39 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-25 05:15 . 2009-03-30 17:08 81984 —-a-w- c:\windows\system32\bdod.bin
2010-05-25 05:15 . 2006-02-08 22:15 ——– d—–w- c:\program files\Eraser
2010-05-25 03:53 . 2005-09-30 00:32 1632 —-a-w- c:\windows\system32\d3d8caps.dat
2010-05-25 03:47 . 2005-11-26 02:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-25 03:46 . 2005-11-26 02:56 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-05-23 05:06 . 2009-08-16 06:33 ——– d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-05-23 02:03 . 2008-10-27 00:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-20 21:32 . 2010-05-20 20:46 1744 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d9caps.tmp
2010-05-20 20:46 . 2010-05-20 20:46 1632 —-a-w- c:\documents and settings\Guest\Local Settings\Application Data\d3d8caps.tmp
2010-05-20 20:25 . 2009-03-30 23:14 1744 —-a-w- c:\documents and settings\kids\Local Settings\Application Data\d3d9caps.tmp
2010-05-16 02:57 . 2008-11-17 18:23 ——– d—–w- c:\program files\Microsoft Silverlight
2010-05-01 03:42 . 2005-12-31 08:39 2209 —-a-w- c:\windows\EntPack.dat
2010-04-29 22:39 . 2008-10-27 00:13 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2008-10-27 00:13 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-10 21:03 . 2008-12-11 16:21 ——– d—–w- c:\documents and settings\DMG\Application Data\Vso
2010-04-10 20:15 . 2009-06-20 23:18 ——– d—–w- c:\documents and settings\kids\Application Data\Vso
2010-03-11 14:28 . 2010-03-11 14:28 61440 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58fc4c41-n\decora-sse.dll
2010-03-11 14:28 . 2010-03-11 14:28 503808 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\msvcp71.dll
2010-03-11 14:28 . 2010-03-11 14:28 499712 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\jmc.dll
2010-03-11 14:28 . 2010-03-11 14:28 348160 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-26e985b8-n\msvcr71.dll
2010-03-11 14:28 . 2010-03-11 14:28 12800 —-a-w- c:\documents and settings\kids\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-58fc4c41-n\decora-d3d.dll
2009-11-13 03:58 . 2008-10-31 00:34 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
2008-08-18 18:21 . 2008-08-18 18:21 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-08-18 18:21 . 2008-08-18 18:21 125848 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-09-23 19:32 . 2008-09-23 19:32 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-25_03.22.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-26 00:45 . 2010-05-26 00:45 16384 c:\windows\Temp\Perflib_Perfdata_1ac.dat
+ 2001-08-23 12:00 . 2010-05-26 00:48 63130 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2010-05-26 00:48 403528 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\eraser.exe" [2003-07-25 536576]
"Eraser RiskMonitor"="c:\program files\East-Tec Eraser 2008\Launch.exe" [2008-03-22 18536]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-01-05 98304]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-13 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

c:\documents and settings\kids\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^DMG^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\DMG\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2006-12-27 22:36 502687 —-a-w- c:\program files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2006-09-28 19:21 57344 —-a-w- c:\program files\SlySoft\CloneCD\CloneCDTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3800 Series]
2005-02-08 03:00 98304 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIACA.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2003-07-25 18:15 536576 —-a-w- c:\program files\Eraser\eraser.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-04 07:56 1667584 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tracks Eraser Pro]
2006-12-16 19:02 1298432 —-a-w- c:\program files\Acesoft\Tracks Eraser Pro\te.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [10/6/2008 5:16 PM 82696]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09 AM 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2/3/2009 5:03 PM 104456]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/21/2009 4:17 PM 135664]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [7/17/2008 12:06 PM 118784]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys –> d:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2010-05-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-26 01:12]

2010-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore1caef2f438e3518.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 23:16]

2010-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 23:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.foxnews.com
mStart Page = hxxp://www.foxnews.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: vzTCPConfig - hxxps://www.verizon.net/WhatsNext/CheckMyPc/vzTCPConfig.CAB
FF - ProfilePath - c:\documents and settings\DMG\Application Data\Mozilla\Firefox\Profiles\azy2tjyk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.foxnews.com
FF - plugin: c:\documents and settings\DMG\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-26 00:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1316)
c:\progra~1\MICROS~2\Office12\GRA8E1~1.DLL
c:\windows\system32\msi.dll
c:\windows\System32\shdoclc.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-05-26 00:23:02
ComboFix-quarantined-files.txt 2010-05-26 07:22
ComboFix2.txt 2010-05-25 03:26

Pre-Run: 103,794,307,072 bytes free
Post-Run: 104,160,878,592 bytes free

- - End Of File - - FAEEDA81E71863EBA933D762435F710E
Post #10
Please do the following;

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
*Mouclass*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #11
SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 08:11 on 26/05/2010 by DMG (Administrator - Elevation successful) ========== filefind ========== Searching for "*Mouclass*" C:\OldDDrive\WINDOWS\system32\drivers\mouclass.sys –a— 22016 bytes [21:54 02/10/2005] [12:00 23/08/2001] E534CCBA5714E8BFFF4FB97D6453898F C:\WINDOWS\$NtServicePackUninstall$\mouclass.sys —–c 22016 bytes [19:00 03/03/2008] [08:27 29/08/2002] 81FB25D6EE5E0728D2C0630C58D7D908 C:\WINDOWS\ServicePackFiles\i386\mouclass.sys —— 23040 bytes [08:27 29/08/2002] [05:58 04/08/2004] 34E1F0031153E491910E12551400192C C:\WINDOWS\system32\drivers\mouclass.sys –a— 23040 bytes [13:47 17/08/2001] [05:58 04/08/2004] 34E1F0031153E491910E12551400192C -=End Of File=-
Post #12
Hi,

Please do the following:


  • Go to Start->Run and type in notepad and hit OK.
  • Then copy and paste the content of the following codebox into Notepad:

    @echo off
copy /y C:\WINDOWS\ServicePackFiles\i386\mouclass.sys  c:\
del %0
  • Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes.
  • Once saved, the icon to click should look like this on your desktop:

    [external image: Posted Image]
  • Double click fix.bat. to run it. A small black box should open and close - this is normal.



NEXT


Print out these instructions to use while in the Recovery Console:
  • Restart your computer.
  • Before Windows loads, you will be prompted to choose which Operating System to start.
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press 'Enter'.
  • At the C:\Windows prompt, type the following bolded entries, and press 'Enter' (note the spaces):

    cd c:\windows\system32\drivers
    ren mouclass.sys mouclass.old
    copy c:\mouclass.sys c:\windows\system32\drivers
    exit

    You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.
    (if you do not see 1 file copied on the screen, even after ensuring the commands are correct, rename the file back to it's original name by typing the following command then hitting Enter.
    ren mouclass.old mouclass.sys
    you should NOT be prompted to overwrite an existing file, but if you are, select No then type exit to restart and notify me of your results)
  • Type exit and press 'Enter'.
  • Reboot normally.
Post #13
Hello, I ran "fix.bat" and the box came and went. When I rebooted and selected recovery, the program started to load and after approx 20 seconds a blue error screen appeared. It had a tech. code stop: 0x0000007b (oXF78D2524, 0Xc0000034, and two more sets of zeros I rebooted twice and got the same results. Thanks, Sailplane
Post #14
1. Please download The Avenger by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All…"
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to move:
c:\mouclass.sys | C:\WINDOWS\system32\drivers\mouclass.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.
Post #15
Earlier in this process I thought I had uninstalled Spybot. During this scan Spybot noticed activity. I selected the "allow" option. I have uninstalled again. Also Bitdefender was triggered. I hadn't disabled the antivirus option there.



Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\mouclass.sys|C:\WINDOWS\system32\drivers\mouclass.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI