What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Persistent Mirar & Vundo infection

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Help! My PC is infected with Mirar and Vundo that I can't seem to shake. I ran Spybot Search & destroy, Malwarebyte and Super Anti-Spyware in safe mode and no dice. I spent most of the weekend chasing this problem to no avail so I humbly come to you for help. A HijackThis Log is pasted below. Can you let me know how to get rid of this problem?

Specifically the problem is hijacked browser and pop ups. Whenever I am on a website I get a pop up related to whatever I am looking at and control passes from my current browser frame to the popup. Even though I use Firefox exclusively I can see in task manager that Microsoft IE is constantly starting up on its own and it sucks up my CPU until usage hits 100%. when I kill IE in the process tab of task manager my CPU usage drops like a rock until IE restarts on its own in a few moments again.

Everytime I run the above mentioned anti-spyware scanners they find a boatload of infections. Once I clean them off and reboot it will rerun at reboot and then a few minutes later the infections will repopulate. I have Mirar on the PC but it won't delete using the add / remove programs function in control panel. I don't know if Mirar is the problem but I would like to remove this as well.

Thanks,

Mark D.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:32:24 PM, on 12/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [CPM67eb7f7f] Rundll32.exe "c:\windows\system32\tererivu.dll",a
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [waseheteyu] Rundll32.exe "C:\WINDOWS\system32\diremuwu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL c:\windows\system32\jidadike.dll c:\windows\system32\yeduziza.dll c:\windows\system32\yapiriva.dll c:\windows\system32\royifego.dll c:\windows\system32\vijopake.dll c:\windows\system32\befivuka.dll c:\windows\system32\jomijoso.dll C:\WINDOWS\system32\hamaveho.dll c:\windows\system32\gopehulo.dll c:\windows\system32\dizepopi.dll c:\windows\system32\tererivu.dll c:\windows\system32\fekidafa.dll c:\windows\system32\bunahotu.dll c:\windows\system32\mirayayu.dll c:\windows\system32\metihoto.dll, c:\windows\system32\yirazuve.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #2
HI MotownMark

Welcome to the What the tech Forums
My name is mschroe919 and I am going to help you with your log.
I would like to help you So if you would….
Please be patient and I will be back as soon as possible.

Please some of these fixes are designed for you particular problem
and while I am fixing with you. Please don't use any other clean up
program, as they may effect the one I give you to use.Also please
if there are any questions please ask and don't delet anything on your own,
there will be some but we will let the programs take care of them.

FIRST :

Download ComboFix to your Desktop.
Get it

HERE:

Or

HERE:


**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish
Post #3 last edited
I ran ComboFix (log attached) and a new HijackThis log (pasted below). Hey…. I have been on my browser for more than a minute and it hasn't been hijacked yet!!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:05:00 PM, on 12/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

–
End of file - 11006 bytes

Attachments:

Post #4
Hi MotownMark

Your log is looking pretty good so far. But we aren't done, I have to check out both of your logs. This will take some time and in the time that I am gone I widh for you to do this on line scan.
Thjis is a extra precaution to make sure all the bad guys are gone.

NEXT:

Using Internet Explorer, please do a

Kaspersky online scan

This scan takes about 60 minutes to complete.

Answer Yes, when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.

[external image: Posted Image]

Click the Save as Text button to save the file to your desktop and post it in your next reply along with a fresh HijackThis log

* Turn off the real time scanner of any existing antivirus program while performing the online scan

I will be back as soon as I can.
I might have to take a break
good luck mschroe919
Post #5
mschroe919 - I made three failed attempts to run Kaspersky. It gets going and then part of the way through the scan IE closes down abruptly on its own even though the PC is not being touched. Whatever I have on my PC is apparently causing IE to shut down spontaneously. I notice in task manager that the iexplore.exe process spontaneously boots and then my CPU Usage spikes up to 100% for a few moments and then settles out to normal levels. If I kill the iexplore.exe process in Task manager it will again spontaneously start up again on its own in a few moments. In any case I can’t get through an on-line scan, can you suggest another approach? In the last Kaspersky scan I noticed that it found 1 infection before it spontaneously closed down. At that point it was about 11 minutes into the scan. Also of note is that Mirar is still showing up in add/remove programs. I do not know if Mirar is related, just passing along the data point. Thanks, MotownMark
Post #6
Good morning,

Lets do another on line scan
if something can't be cleaned make note of it and let me know
do the scan here:
http://support.f-secure.com/enu/home/ols.shtml
the start scanning button is at bottom of page
good luck mschroe919
Post #7
Here is the scan result: Scanning Report Wednesday, December 17, 2008 20:30:06 - 23:06:07 Computer name: JOAN Scanning type: Scan system for malware, rootkits Target: C:\ Result: 9 malware found Trojan-Downloader.Win32.Firu (virus) * System Trojan-Downloader.Win32.Firu.sn (virus) * C:\WINDOWS\SYSTEM32\YBY34200.EXE Trojan-Downloader:W32/Agent.IFD (virus) * System * C:\WINDOWS\SYSTEM32\R01ASD3X.EXE Trojan-Spy.Win32.Agent (virus) * System Trojan-Spy.Win32.Agent.evp (virus) * C:\WINDOWS\SYSTEM32\KANASODA.DLL * C:\WINDOWS\SYSTEM32\KIGADASI.DLL * C:\WINDOWS\SYSTEM32\VUVEROFI.DLL * C:\WINDOWS\SYSTEM32\WIWOBIBI.DLL Statistics Scanned: * Files: 51041 * System: 3425 * Not scanned: 23 Actions: * Disinfected: 0 * Renamed: 0 * Deleted: 0 * None: 9 * Submitted: 0 Files not scanned: * C:\HIBERFIL.SYS * C:\PAGEFILE.SYS * C:\WINDOWS\TEMP\MCMSC_GOXAE57XLGCH56C * C:\WINDOWS\TEMP\MCMSC_HBQIVRG5MJJMXXN * C:\WINDOWS\TEMP\MCMSC_I3G0JYKGXLTB2JZ * C:\WINDOWS\TEMP\SQLITE_3KMZAAX0LAWU3KW * C:\WINDOWS\TEMP\SQLITE_5VBVO1D4BD0PNUB * C:\WINDOWS\TEMP\SQLITE_E1NGJARMU9WAAML * C:\WINDOWS\TEMP\SQLITE_T4YL24RN42ADUMA * C:\WINDOWS\TEMP\SQLITE_UL1BGNVFO8RUDQQ * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT * C:\WINDOWS\SYSTEM32\CONFIG\SAM * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\TEMP\SQLITE_MINE0W7J8AXHECA * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\DBDAM * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\DBDAO * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\DBEAM * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\DBEAO * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\DBM * C:\DOCUMENTS AND SETTINGS\JOAN DELUCA\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\GOOGLE DESKTOP\83ECDBBD1108\HP * C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3AD391678A806EC4D691E83AAA393B6F_24ADF822-76F7-4481-B30B-FF1B40F8687F Options Scanning engines: * F-Secure USS: 2.40.0 * F-Secure Hydra: 2.8.8110, 2008-12-18 * F-Secure AVP: 7.0.171, 2008-12-17 * F-Secure Pegasus: 1.20.0, 2008-11-10 * F-Secure Blacklight: 2.4.1093 Scanning options: * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR * Use Advanced heuristics Copyright © 1998-2007 Product support |Send virus sample to F-Secure
Post #8
Hi
sorry about getting back so late. Had problems

Can you do me a favor an get the log fro combofix and post it here again
Please don't attach it. Copy and paste it here I think by attaching it I missed parts of it

when you attached tjhe file rhe file came to me in a different format and I had to convert it and doing so I lost some parts.
I will be waitng for the combofix log

good luck
mschroe919
Post #9
mschroe919 - As you may remember you asked me to run combofix a few days ago. Back then the instructions specified that if I already had combofix on the machine that I should delete and reload it. I assume that it is OK for me now to just rerun combofix without deleting the program and then reinstalling it? Thanks, MotownMark
Post #10
Here is the combofix log:

ComboFix 08-12-16.03 - Joan DeLuca 2008-12-18 20:29:57.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.434 [GMT -5:00]
Running from: c:\user\Downloads\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\R01asD3X.exe.a_a

.
((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-17 20:22 . 2008-12-17 20:22 d——– C:\fsaua.data
2008-12-15 21:29 . 2008-12-15 21:29 d——– c:\program files\Trend Micro
2008-12-14 09:39 . 2008-12-14 09:37 410,984 –a—— c:\windows\system32\deploytk.dll
2008-12-14 09:39 . 2008-12-14 09:37 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-12-14 00:23 . 2008-12-14 00:44 d——– c:\program files\Spybot - Search & Destroy
2008-12-14 00:23 . 2008-12-14 09:25 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-13 23:56 . 2008-12-14 17:32 d-a—— c:\documents and settings\All Users\Application Data\TEMP
2008-12-13 23:48 . 2005-04-15 20:58 1,071,088 –a—— c:\windows\system32\is-RQ9SU.tmp
2008-12-09 00:47 . 2008-12-09 00:47 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-09 00:47 . 2008-12-09 00:47 d——– c:\documents and settings\Joan DeLuca\Application Data\Malwarebytes
2008-12-09 00:47 . 2008-12-09 00:47 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-09 00:47 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-09 00:47 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 04:17 ——— d—–w c:\program files\McAfee
2008-12-17 01:27 ——— d—–w c:\program files\SpywareGuard
2008-12-14 22:31 ——— d—–w c:\program files\SpywareBlaster
2008-12-14 14:37 ——— d—–w c:\program files\Java
2008-12-14 05:08 ——— d—–w c:\program files\DIGStream
2008-12-14 05:07 ——— d—–w c:\documents and settings\Joan DeLuca\Application Data\Lavasoft
2008-12-12 17:27 3,067,392 ——w c:\windows\system32\dllcache\mshtml.dll
2008-12-09 04:59 ——— d—–w c:\program files\Common Files\Intuit
2008-12-09 04:52 ——— d—–w c:\program files\Common Files\AOL
2008-12-09 04:52 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2008-12-09 04:51 ——— d—–w c:\program files\Common Files\aolshare
2008-12-09 04:41 ——— d—–w c:\program files\SUPERAntiSpyware
2008-12-06 00:14 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2008-10-24 11:10 453,632 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ——w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-23 13:01 283,648 ——w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\dllcache\wups.dll
2008-10-15 16:57 332,800 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-15 14:18 18,432 ——w c:\windows\system32\dllcache\iedw.exe
2008-10-03 10:15 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-10-03 10:15 247,326 ——w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2007-02-10 21:58 32 —-a-r c:\documents and settings\All Users\hash.dat
2008-08-30 21:58 122,880 —-a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2006-02-05 19:02 56 –sh–r c:\windows\system32\DDA5B02E4A.sys
2006-02-05 19:02 3,766 –sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-16_19.59.52.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-02-27 20:59:28 290,816 —-a-w c:\windows\Downloaded Program Files\auc_lib.dll
+ 2008-02-27 20:59:28 495,616 —-a-w c:\windows\Downloaded Program Files\daas_s.dll
+ 2008-02-27 21:00:12 262,144 —-a-w c:\windows\Downloaded Program Files\fscax.dll
+ 2008-02-27 20:59:16 588,392 —-a-w c:\windows\Downloaded Program Files\gatelauncher.exe
- 2006-05-05 09:41:45 453,120 ——w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-10-24 11:10:42 453,632 ——w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-12-17 04:24:00 32,768 —-a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2008-08-20 05:33:19 1,024,000 —-a-w c:\windows\system32\browseui.dll
+ 2008-10-16 10:20:52 1,024,000 —-a-w c:\windows\system32\browseui.dll
- 2008-08-20 05:33:17 151,040 —-a-w c:\windows\system32\cdfview.dll
+ 2008-10-16 10:20:42 151,040 —-a-w c:\windows\system32\cdfview.dll
- 2008-12-17 00:44:10 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-18 21:28:48 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-12-17 00:44:10 16,384 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-18 21:28:48 16,384 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-20 05:33:18 1,054,208 —-a-w c:\windows\system32\danim.dll
+ 2008-10-16 10:20:45 1,054,208 —-a-w c:\windows\system32\danim.dll
- 2008-08-20 05:33:19 1,024,000 ——w c:\windows\system32\dllcache\browseui.dll
+ 2008-10-16 10:20:52 1,024,000 ——w c:\windows\system32\dllcache\browseui.dll
- 2008-08-20 05:33:17 151,040 ——w c:\windows\system32\dllcache\cdfview.dll
+ 2008-10-16 10:20:42 151,040 ——w c:\windows\system32\dllcache\cdfview.dll
- 2008-08-20 05:33:18 1,054,208 ——w c:\windows\system32\dllcache\danim.dll
+ 2008-10-16 10:20:45 1,054,208 ——w c:\windows\system32\dllcache\danim.dll
- 2008-08-20 05:33:18 357,888 ——w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 10:20:45 357,888 ——w c:\windows\system32\dllcache\dxtmsft.dll
- 2008-08-20 05:33:18 205,312 ——w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 10:20:45 205,312 ——w c:\windows\system32\dllcache\dxtrans.dll
- 2008-08-20 05:33:18 55,808 ——w c:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 10:20:46 55,808 ——w c:\windows\system32\dllcache\extmgr.dll
- 2008-08-20 05:33:18 251,904 ——w c:\windows\system32\dllcache\iepeers.dll
+ 2008-10-16 10:20:46 251,904 ——w c:\windows\system32\dllcache\iepeers.dll
- 2008-08-20 05:33:18 96,256 ——w c:\windows\system32\dllcache\inseng.dll
+ 2008-10-16 10:20:46 96,256 ——w c:\windows\system32\dllcache\inseng.dll
- 2008-08-20 05:33:19 16,384 ——w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 10:20:50 16,384 ——w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-06-11 07:47:52 96,768 ——w c:\windows\system32\dllcache\logagent.exe
- 2008-08-20 05:33:19 449,024 ——w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 10:20:50 449,024 ——w c:\windows\system32\dllcache\mshtmled.dll
- 2008-08-20 05:33:18 146,432 ——w c:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 10:20:46 146,432 ——w c:\windows\system32\dllcache\msrating.dll
- 2008-08-20 05:33:18 532,480 ——w c:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 10:20:46 532,480 ——w c:\windows\system32\dllcache\mstime.dll
- 2007-06-26 06:08:16 1,104,896 ——w c:\windows\system32\dllcache\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 ——w c:\windows\system32\dllcache\msxml3.dll
- 2008-08-20 05:33:18 39,424 ——w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 10:20:46 39,424 ——w c:\windows\system32\dllcache\pngfilt.dll
- 2008-08-20 05:33:19 1,499,136 ——w c:\windows\system32\dllcache\shdocvw.dll
+ 2008-10-16 10:20:48 1,499,136 ——w c:\windows\system32\dllcache\shdocvw.dll
- 2008-08-20 05:33:19 474,112 ——w c:\windows\system32\dllcache\shlwapi.dll
+ 2008-10-16 10:20:51 474,112 ——w c:\windows\system32\dllcache\shlwapi.dll
- 2008-08-20 05:33:19 619,008 ——w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 10:20:53 619,008 ——w c:\windows\system32\dllcache\urlmon.dll
- 2008-08-20 05:33:19 667,648 ——w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 10:20:49 667,648 ——w c:\windows\system32\dllcache\wininet.dll
+ 2008-06-11 07:58:16 988,672 ——w c:\windows\system32\dllcache\WMNetmgr.dll
- 2006-12-07 04:14:51 2,330,624 ——w c:\windows\system32\dllcache\wmvcore.dll
+ 2008-06-11 07:58:24 2,330,624 ——w c:\windows\system32\dllcache\WMVCore.dll
- 2008-08-20 05:33:18 357,888 —-a-w c:\windows\system32\dxtmsft.dll
+ 2008-10-16 10:20:45 357,888 —-a-w c:\windows\system32\dxtmsft.dll
- 2008-08-20 05:33:18 205,312 —-a-w c:\windows\system32\dxtrans.dll
+ 2008-10-16 10:20:45 205,312 —-a-w c:\windows\system32\dxtrans.dll
- 2008-08-20 05:33:18 55,808 —-a-w c:\windows\system32\extmgr.dll
+ 2008-10-16 10:20:46 55,808 —-a-w c:\windows\system32\extmgr.dll
- 2008-08-20 05:33:18 251,904 —-a-w c:\windows\system32\iepeers.dll
+ 2008-10-16 10:20:46 251,904 —-a-w c:\windows\system32\iepeers.dll
- 2008-08-20 05:33:18 96,256 —-a-w c:\windows\system32\inseng.dll
+ 2008-10-16 10:20:46 96,256 —-a-w c:\windows\system32\inseng.dll
- 2008-08-20 05:33:19 16,384 —-a-w c:\windows\system32\jsproxy.dll
+ 2008-10-16 10:20:50 16,384 —-a-w c:\windows\system32\jsproxy.dll
- 2005-08-04 00:29:52 96,768 —-a-w c:\windows\system32\logagent.exe
+ 2008-06-11 07:47:52 96,768 —-a-w c:\windows\system32\logagent.exe
+ 2008-12-09 20:24:38 17,593,280 —-a-w c:\windows\system32\MRT.exe
- 2008-08-20 05:33:20 3,067,392 —-a-w c:\windows\system32\mshtml.dll
+ 2008-12-12 17:27:54 3,067,392 —-a-w c:\windows\system32\mshtml.dll
- 2008-08-20 05:33:19 449,024 —-a-w c:\windows\system32\mshtmled.dll
+ 2008-10-16 10:20:50 449,024 —-a-w c:\windows\system32\mshtmled.dll
- 2008-08-20 05:33:18 146,432 —-a-w c:\windows\system32\msrating.dll
+ 2008-10-16 10:20:46 146,432 —-a-w c:\windows\system32\msrating.dll
- 2008-08-20 05:33:18 532,480 —-a-w c:\windows\system32\mstime.dll
+ 2008-10-16 10:20:46 532,480 —-a-w c:\windows\system32\mstime.dll
- 2007-06-26 06:08:16 1,104,896 —-a-w c:\windows\system32\msxml3.dll
+ 2008-09-04 16:42:02 1,106,944 —-a-w c:\windows\system32\msxml3.dll
- 2008-08-20 05:33:18 39,424 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-10-16 10:20:46 39,424 —-a-w c:\windows\system32\pngfilt.dll
- 2008-08-20 05:33:19 1,499,136 —-a-w c:\windows\system32\shdocvw.dll
+ 2008-10-16 10:20:48 1,499,136 —-a-w c:\windows\system32\shdocvw.dll
- 2008-08-20 05:33:19 474,112 —-a-w c:\windows\system32\shlwapi.dll
+ 2008-10-16 10:20:51 474,112 —-a-w c:\windows\system32\shlwapi.dll
+ 2008-10-16 19:08:58 34,328 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 19:09:44 43,544 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
- 2007-11-30 11:18:51 17,272 ——w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
- 2008-07-14 11:09:18 62,976 ——w c:\windows\system32\tzchange.exe
+ 2008-10-22 09:47:07 62,976 ——w c:\windows\system32\tzchange.exe
- 2008-08-20 05:33:19 619,008 —-a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 10:20:53 619,008 —-a-w c:\windows\system32\urlmon.dll
- 2008-08-20 05:33:19 667,648 —-a-w c:\windows\system32\wininet.dll
+ 2008-10-16 10:20:49 667,648 —-a-w c:\windows\system32\wininet.dll
- 2005-08-04 00:29:52 988,672 —-a-w c:\windows\system32\wmnetmgr.dll
+ 2008-06-11 07:58:16 988,672 —-a-w c:\windows\system32\WMNetmgr.dll
- 2006-12-07 04:14:51 2,330,624 —-a-w c:\windows\system32\wmvcore.dll
+ 2008-06-11 07:58:24 2,330,624 —-a-w c:\windows\system32\WMVCore.dll
- 2008-08-19 09:20:32 351,744 —-a-w c:\windows\system32\xpsp3res.dll
+ 2008-10-15 14:00:41 351,744 —-a-w c:\windows\system32\xpsp3res.dll
+ 2008-12-18 14:12:39 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_6a4.dat
+ 2008-09-30 21:42:08 1,286,152 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-09-30 21:45:12 91,656 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-06 50528]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-16 68856]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-08 1809648]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-09-01 684032]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-12-14 98304]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MMTray"="c:\progra~1\MUSICM~1\MUSICM~3\mm_tray.exe" [2005-09-08 110592]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-30 29744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-24 218496]

c:\documents and settings\Joan DeLuca\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2005-12-14 156784]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-22 45056]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-14 24576]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-12-08 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-08 23:40 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 17:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1135485497\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1135485497\\ee\\aim6.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\DellSupport\\DSAgnt.exe"=
"c:\\WINDOWS\\ehome\\ehtray.exe"=
"c:\\Program Files\\McAfee\\SiteAdvisor\\McSACore.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\iFrmewrk.exe"=
"c:\\Program Files\\Digital Line Detect\\DLG.exe"=
"c:\\Program Files\\SpywareGuard\\sgbhp.exe"=
"c:\\Program Files\\McAfee.com\\Agent\\mcagent.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-02-29 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-02-29 55024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-09-26 206096]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-02-26 24652]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-12-09 29744]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-09 c:\windows\Tasks\At1.job
- c:\windows\system32\yBY34200.exe []

2008-12-14 c:\windows\Tasks\At10.job
- c:\windows\system32\yBY34200.exe []

2008-12-03 c:\windows\Tasks\At11.job
- c:\windows\system32\yBY34200.exe []

2008-12-05 c:\windows\Tasks\At12.job
- c:\windows\system32\yBY34200.exe []

2008-12-13 c:\windows\Tasks\At13.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At14.job
- c:\windows\system32\yBY34200.exe []

2008-12-13 c:\windows\Tasks\At15.job
- c:\windows\system32\yBY34200.exe []

2008-12-13 c:\windows\Tasks\At16.job
- c:\windows\system32\yBY34200.exe []

2008-12-13 c:\windows\Tasks\At17.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At18.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At19.job
- c:\windows\system32\yBY34200.exe []

2008-11-16 c:\windows\Tasks\At2.job
- c:\windows\system32\yBY34200.exe []

2008-12-15 c:\windows\Tasks\At20.job
- c:\windows\system32\yBY34200.exe []

2008-12-17 c:\windows\Tasks\At21.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At22.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At23.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At24.job
- c:\windows\system32\yBY34200.exe []

2008-12-15 c:\windows\Tasks\At25.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At26.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At27.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At28.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At29.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At3.job
- c:\windows\system32\yBY34200.exe []

2008-11-16 c:\windows\Tasks\At30.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At31.job
- c:\windows\system32\R01asD3X.exe []

2008-12-09 c:\windows\Tasks\At32.job
- c:\windows\system32\R01asD3X.exe []

2008-12-09 c:\windows\Tasks\At33.job
- c:\windows\system32\R01asD3X.exe []

2008-12-14 c:\windows\Tasks\At34.job
- c:\windows\system32\R01asD3X.exe []

2008-12-03 c:\windows\Tasks\At35.job
- c:\windows\system32\R01asD3X.exe []

2008-12-05 c:\windows\Tasks\At36.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At37.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At38.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At39.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At4.job
- c:\windows\system32\yBY34200.exe []

2008-12-13 c:\windows\Tasks\At40.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At41.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At42.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At43.job
- c:\windows\system32\R01asD3X.exe []

2008-12-15 c:\windows\Tasks\At44.job
- c:\windows\system32\R01asD3X.exe []

2008-12-17 c:\windows\Tasks\At45.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At46.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At47.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At48.job
- c:\windows\system32\R01asD3X.exe []

2008-12-14 c:\windows\Tasks\At49.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At5.job
- c:\windows\system32\yBY34200.exe []

2008-11-22 c:\windows\Tasks\At50.job
- c:\windows\system32\R01asD3X.exe []

2008-11-22 c:\windows\Tasks\At51.job
- c:\windows\system32\R01asD3X.exe []

2008-11-22 c:\windows\Tasks\At52.job
- c:\windows\system32\R01asD3X.exe []

2008-11-22 c:\windows\Tasks\At53.job
- c:\windows\system32\R01asD3X.exe []

2008-11-22 c:\windows\Tasks\At54.job
- c:\windows\system32\R01asD3X.exe []

2008-11-22 c:\windows\Tasks\At55.job
- c:\windows\system32\R01asD3X.exe []

2008-12-09 c:\windows\Tasks\At56.job
- c:\windows\system32\R01asD3X.exe []

2008-12-09 c:\windows\Tasks\At57.job
- c:\windows\system32\R01asD3X.exe []

2008-12-14 c:\windows\Tasks\At58.job
- c:\windows\system32\R01asD3X.exe []

2008-12-03 c:\windows\Tasks\At59.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At6.job
- c:\windows\system32\yBY34200.exe []

2008-12-05 c:\windows\Tasks\At60.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At61.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At62.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At63.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At64.job
- c:\windows\system32\R01asD3X.exe []

2008-12-13 c:\windows\Tasks\At65.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At66.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At67.job
- c:\windows\system32\R01asD3X.exe []

2008-12-15 c:\windows\Tasks\At68.job
- c:\windows\system32\R01asD3X.exe []

2008-12-17 c:\windows\Tasks\At69.job
- c:\windows\system32\R01asD3X.exe []

2008-11-16 c:\windows\Tasks\At7.job
- c:\windows\system32\yBY34200.exe []

2008-12-18 c:\windows\Tasks\At70.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At71.job
- c:\windows\system32\R01asD3X.exe []

2008-12-18 c:\windows\Tasks\At72.job
- c:\windows\system32\R01asD3X.exe []

2008-12-09 c:\windows\Tasks\At8.job
- c:\windows\system32\yBY34200.exe []

2008-12-09 c:\windows\Tasks\At9.job
- c:\windows\system32\yBY34200.exe []

2008-11-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-08-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.dell4me.com/myway
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell4me.com/myway
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Joan DeLuca\Application Data\Mozilla\Firefox\Profiles\ttve2vob.default\
FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service
FF - plugin: c:\program files\Mozilla Firefox\plugins\np32dsw.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npaxctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npnul32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-18 20:34:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1124)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Completion time: 2008-12-18 20:37:35
ComboFix-quarantined-files.txt 2008-12-19 01:36:33
ComboFix2.txt 2008-12-17 01:39:15
ComboFix3.txt 2008-12-17 01:02:04

Pre-Run: 52,070,494,208 bytes free
Post-Run: 52,229,967,872 bytes free

453 — E O F — 2008-12-18 04:16:01
Post #11
Hi

The grand kids are keeoing me hoping, but don't give up on me I am going to stay till your clean.

NEXT:

NEXT:
1. Please open Notepad
Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
c:\windows\system32\is-RQ9SU.tmp
c:\windows\system32\DDA5B02E4A.sys
c:\windows\system32\kanasoda.dll
c:\windows\system32\wiwobibi.dll
c:\windows\system32\yBY34200.exe
c:\windows\system32\R01asD3X.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
[external image: Posted Image]
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Next, re-enable all the programs that you disabled prior to running ComboFix.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

8. Post the following logs/Reports:
ComboFix.txt
Fresh HijackThis log

good luk mschroe919
Post #13
mschroe919 - Sorry for the delay, I got caught up over the weekend. I did not yet implement the CF Script instructions that you gave on December 19th but my wife says that her PC is behaving well. Should I still do it? Just checking, if there are problems lurking on her PC I want to eradicate them but I want to be sure that this last step is necessary. Thanks, I very much appreciate your help, MotownMark
Post #14
Hi Yes it is important that we get rid of those. They are the bad guys lurking and waiting to attack. Please follow the instructions as they are. When your done as it says, post another fresh HJT log as well as the ComboFix.txt good luck mschroe919 And Happy hoildays to you and yours
Post #15
Just checking as to how your doing wirh the latest instructions, we aren't done so if you want help let me know as I have to close the post thanks mschroe919

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI