What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] popup virus

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I used spybot and avg and cant seem to get rid of this problem. I ran Hijack this and Combofix and the log files are below.Thanks for any help.

Hijack This:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:09 PM, on 12/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\Diamondback 3G\razertra.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback 3G\razerhid.exe
O4 - HKCU\..\Run: [Wootalyzer] C:\Program Files\Wootalyzer\woot.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: ruqmzo.dll mbwstd.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 3769 bytes


Combo Fix:
ComboFix 08-12-24.01 - Jay Berdia 2008-12-24 20:01:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.502 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\egdtdy.dll
c:\windows\system32\geBrsPhI.dll
c:\windows\system32\htbertvq.dll
c:\windows\system32\IhPsrBeg.ini
c:\windows\system32\IhPsrBeg.ini2
c:\windows\system32\jybkcjqo.dll
c:\windows\system32\mbwstd.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\omdwkolu.dll
c:\windows\system32\TDSSdxcp.dll
c:\windows\system32\TDSSmtye.dat
c:\windows\system32\tsljfvnb.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_TDSSSERV.SYS
——-\Service_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-11-25 to 2008-12-25 )))))))))))))))))))))))))))))))
.

2008-12-24 19:58 . 2008-12-24 19:58 d——– c:\program files\Trend Micro
2008-12-24 00:36 . 2008-12-24 00:36 d——– c:\program files\DIFX
2008-12-24 00:32 . 2008-12-24 00:32 d——– c:\program files\Razer
2008-12-24 00:32 . 2007-06-29 16:44 73,728 –a—— c:\windows\system32\diamondback.cpl
2008-12-24 00:32 . 2005-04-24 22:43 13,225 –a—— c:\windows\system32\drivers\DB3G.sys
2008-12-24 00:31 . 2008-12-24 00:31 d——– c:\documents and settings\Jay Berdia\Application Data\InstallShield
2008-12-23 23:26 . 2008-12-23 23:26 126,976 –a—— c:\windows\War3Unin.exe
2008-12-23 23:26 . 2008-12-24 00:53 23,680 –a—— c:\windows\War3Unin.dat
2008-12-23 23:26 . 2008-12-23 23:26 2,829 –a—— c:\windows\War3Unin.pif
2008-12-23 23:25 . 2008-12-23 23:25 d——– C:\VundoFix Backups
2008-12-23 23:20 . 2008-12-24 19:03 d——– c:\program files\Warcraft III
2008-12-23 20:54 . 2008-12-23 20:54 120 –ahs—- c:\windows\system32\qvtrebth.ini
2008-12-23 19:38 . 2008-12-23 19:38 120 –ahs—- c:\windows\system32\ulokwdmo.ini
2008-12-22 13:48 . 2008-12-23 23:13 d——– c:\documents and settings\Jay Berdia\.housecall6.6
2008-12-22 12:50 . 2008-12-23 23:11 131,584 –a—— c:\windows\system32\mkpzvpfx.zqm
2008-12-22 12:47 . 2008-12-22 12:47 120 –ahs—- c:\windows\system32\uxxwwmbr.ini
2008-12-22 02:28 . 2008-12-22 13:45 162 –a—— c:\windows\wininit.ini
2008-12-22 01:29 . 2008-12-22 13:06 d–h—– C:\$AVG8.VAULT$
2008-12-21 22:19 . 2008-12-22 02:06 81,984 –a—— c:\windows\system32\bdod.bin
2008-12-21 22:10 . 2008-12-22 02:07 d——– c:\program files\Common Files\Softwin
2008-12-21 21:16 . 2008-12-24 08:40 d——– c:\windows\system32\drivers\Avg
2008-12-21 21:16 . 2008-12-21 21:16 97,928 –a—— c:\windows\system32\drivers\avgldx86.sys
2008-12-21 21:16 . 2008-12-21 21:16 10,520 –a—— c:\windows\system32\avgrsstx.dll
2008-12-21 20:53 . 2008-12-21 21:19 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-12-21 20:50 . 2008-12-21 20:50 d——– c:\program files\AVG
2008-12-21 10:40 . 2008-12-21 21:16 d——– c:\documents and settings\Administrator
2008-12-21 10:26 . 2008-12-21 10:26 d——– c:\program files\Lavasoft
2008-12-21 10:26 . 2008-12-22 02:09 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-21 10:19 . 2008-12-22 12:43 d——– c:\program files\Spybot - Search & Destroy
2008-12-21 10:19 . 2008-12-22 02:53 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-18 21:33 . 2008-12-24 19:12 d——– c:\program files\Full Tilt Poker
2008-12-06 13:06 . 2008-12-06 13:06 0 –a—— c:\windows\QuickInstall.INI
2008-12-06 12:54 . 2008-12-06 13:06 d——– c:\program files\palmOne

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-24 06:32 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-11 20:07 ——— d—–w c:\program files\Common Files\Adobe
2008-11-10 05:42 ——— d—–w c:\program files\MSECache
2008-11-10 05:42 ——— d—–w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-10 05:38 ——— d—–w c:\program files\Microsoft Visual Studio 8
2008-11-10 05:32 ——— d—–w c:\program files\Microsoft Works
2008-11-10 05:31 ——— d—–w c:\program files\MSBuild
2008-11-10 05:30 ——— d—–w c:\program files\Microsoft.NET
2008-11-10 04:12 ——— d—–w c:\program files\Common Files\Deterministic Networks
2008-11-10 04:12 ——— d—–w c:\program files\Cisco Systems
2008-10-28 20:34 ——— d—–w c:\program files\Sling Media
2008-10-28 20:34 ——— d—–w c:\documents and settings\All Users\Application Data\Sling Media
2008-10-23 13:01 283,648 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 20:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 20:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 20:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 10:37 659,456 —-a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-09-30 22:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-01-10 07:06 32 —-a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wootalyzer"="c:\program files\Wootalyzer\woot.exe" [2008-06-27 392192]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-22 94208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2007-08-20 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2007-08-20 158208]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-21 1261336]
"Diamondback"="c:\program files\Razer\Diamondback 3G\razerhid.exe" [2007-08-01 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ruqmzo.dll mbwstd.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jay Berdia^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Jay Berdia\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 18:51 39792 c:\program files\Adobe\Reader 8.0\Reader\Reader_SL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 09:37 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
–a—— 2005-01-31 15:35 155648 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
–a—— 2006-08-22 09:52 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a–c— 2007-08-20 16:04 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
–a—— 2007-10-25 16:33 563984 c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2007-10-25 16:37 2178832 c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 16:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 03:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-12-13 14:52 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wootalyzer]
–a—— 2008-06-27 18:07 392192 c:\program files\Wootalyzer\woot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
–a—— 2007-08-20 16:03 110592 c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SlingAgentService"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"MDM"=2 (0x2)
"LVPrcSrv"=2 (0x2)
"LVCOMSer"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"CVPND"=2 (0x2)
"NBService"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-21 97928]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-21 231704]
R3 Razerlow;Diamondback 3G USB Filter Driver;c:\windows\system32\Drivers\DB3G.sys [2008-12-24 13225]
S4 SlingAgentService;SlingAgent Service;"c:\program files\Sling Media\SlingAgent\SlingAgentService.exe" [2008-09-21 93960]
.
Contents of the 'Scheduled Tasks' folder

2008-12-25 c:\windows\Tasks\pxbtllar.job
- c:\windows\system32\rundll32.exe [2007-08-20 16:16]
.
- - - - ORPHANS REMOVED - - - -

BHO-{96ac47c2-ccc1-45b4-9bc9-d6d720bb1a1a} - c:\windows\system32\mbwstd.dll
BHO-{A1B1C518-7C1C-4AAF-87FA-CB7AFB29AA8A} - c:\windows\system32\geBrsPhI.dll
Notify-byXRhGyA - byXRhGyA.dll
MSConfigStartUp-202e4afc - c:\windows\system32\xdlmhsxq.dll
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
MSConfigStartUp-Jnskdfmf9eldfd - c:\docume~1\JAYBER~1\LOCALS~1\Temp\csrssc.exe
MSConfigStartUp-jsf8j34rgfght - c:\docume~1\JAYBER~1\LOCALS~1\Temp\winloggn.exe
MSConfigStartUp-prunnet - c:\windows\system32\prunnet.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jay Berdia\Application Data\Mozilla\Firefox\Profiles\vasvv8a9.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-24 20:08:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Razer\Diamondback 3G\razertra.exe
c:\program files\Razer\Diamondback 3G\razerofa.exe
.
**************************************************************************
.
Completion time: 2008-12-24 20:13:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-25 02:13:41

Pre-Run: 20,745,789,440 bytes free
Post-Run: 20,748,070,912 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

228 — E O F — 2008-12-19 03:21:35
Post #2
:welcome:

My name is BHowett and I will be helping you to get sorted. If for any reason you do not understand any of the instructions, or are just unsure then please do not guess , simply post back with your question, and we will go through it again.

Do NOT run tools unless you are instructed to do so. Some of the tools we use can turn your system into an expensive paper weight if not use correctly.

Please re-run Combofix then post a fresh log along with a fresh HijackThis log. Also let me know how things are running now.
Post #3
Thanks for your response. I am still getting random popups from IE when I am using Mozilla. Also I noticed some slowdown on my computer but I am not sure if it is related to the virus. I reran combofix and hijack this and the logs are below.

ComboFix:

ComboFix 08-12-26.03 - Jay Berdia 2008-12-26 19:33:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.632 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\livulene.dll
c:\windows\system32\magohupa.dll
c:\windows\system32\mewivadi.dll
c:\windows\system32\qvtrebth.ini
c:\windows\system32\semajosu.dll
c:\windows\system32\ulokwdmo.ini
c:\windows\system32\usojames.ini
c:\windows\system32\uxxwwmbr.ini
c:\windows\system32\zugowuva.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-26 19:29 . 2008-12-26 19:29 d——– c:\program files\Trend Micro
2008-12-24 00:36 . 2008-12-24 00:36 d——– c:\program files\DIFX
2008-12-24 00:32 . 2008-12-24 00:32 d——– c:\program files\Razer
2008-12-24 00:32 . 2007-06-29 16:44 73,728 –a—— c:\windows\system32\diamondback.cpl
2008-12-24 00:32 . 2005-04-24 22:43 13,225 –a—— c:\windows\system32\drivers\DB3G.sys
2008-12-24 00:31 . 2008-12-24 00:31 d——– c:\documents and settings\Jay Berdia\Application Data\InstallShield
2008-12-23 23:26 . 2008-12-23 23:26 126,976 –a—— c:\windows\War3Unin.exe
2008-12-23 23:26 . 2008-12-24 00:53 23,680 –a—— c:\windows\War3Unin.dat
2008-12-23 23:26 . 2008-12-23 23:26 2,829 –a—— c:\windows\War3Unin.pif
2008-12-23 23:20 . 2008-12-24 20:44 d——– c:\program files\Warcraft III
2008-12-22 13:48 . 2008-12-23 23:13 d——– c:\documents and settings\Jay Berdia\.housecall6.6
2008-12-22 12:50 . 2008-12-23 23:11 131,584 –a—— c:\windows\system32\mkpzvpfx.zqm
2008-12-22 02:28 . 2008-12-22 13:45 162 –a—— c:\windows\wininit.ini
2008-12-21 22:19 . 2008-12-22 02:06 81,984 –a—— c:\windows\system32\bdod.bin
2008-12-21 22:10 . 2008-12-22 02:07 d——– c:\program files\Common Files\Softwin
2008-12-21 20:53 . 2008-12-25 23:23 d——– c:\documents and settings\All Users\Application Data\Avg8
2008-12-21 10:40 . 2008-12-21 21:16 d——– c:\documents and settings\Administrator
2008-12-21 10:26 . 2008-12-21 10:26 d——– c:\program files\Lavasoft
2008-12-21 10:26 . 2008-12-22 02:09 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-21 10:19 . 2008-12-25 23:20 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-18 21:33 . 2008-12-26 02:55 d——– c:\program files\Full Tilt Poker
2008-12-06 13:06 . 2008-12-06 13:06 0 –a—— c:\windows\QuickInstall.INI
2008-12-06 12:54 . 2008-12-06 13:06 d——– c:\program files\palmOne

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-24 06:32 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-11 20:07 ——— d—–w c:\program files\Common Files\Adobe
2008-11-10 05:42 ——— d—–w c:\program files\MSECache
2008-11-10 05:42 ——— d—–w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-10 05:38 ——— d—–w c:\program files\Microsoft Visual Studio 8
2008-11-10 05:32 ——— d—–w c:\program files\Microsoft Works
2008-11-10 05:31 ——— d—–w c:\program files\MSBuild
2008-11-10 05:30 ——— d—–w c:\program files\Microsoft.NET
2008-11-10 04:12 ——— d—–w c:\program files\Common Files\Deterministic Networks
2008-11-10 04:12 ——— d—–w c:\program files\Cisco Systems
2008-10-28 20:34 ——— d—–w c:\program files\Sling Media
2008-10-28 20:34 ——— d—–w c:\documents and settings\All Users\Application Data\Sling Media
2008-01-10 07:06 32 —-a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-09-26 09:02 60,928 –sha-w c:\windows\system32\gezimihe.dll
2008-09-26 09:02 60,928 –sha-w c:\windows\system32\hofalobu.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{607af8d1-d87b-4870-82c4-212a2c5aaad5}]
2008-09-26 03:02 60928 –ahs—- c:\windows\system32\gezimihe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wootalyzer"="c:\program files\Wootalyzer\woot.exe" [2008-06-27 392192]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-22 94208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2007-08-20 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2007-08-20 158208]
"Diamondback"="c:\program files\Razer\Diamondback 3G\razerhid.exe" [2007-08-01 147456]
"kegibafari"="c:\windows\system32\hofalobu.dll" [2008-09-26 60928]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\windows\system32\magohupa.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Jay Berdia^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Jay Berdia\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 18:51 39792 c:\program files\Adobe\Reader 8.0\Reader\Reader_SL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 09:37 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
–a—— 2005-01-31 15:35 155648 c:\program files\Apoint\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
–a—— 2006-08-22 09:52 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a–c— 2007-08-20 16:04 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
–a—— 2007-10-25 16:33 563984 c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2007-10-25 16:37 2178832 c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2006-01-12 16:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 03:25 144784 c:\program files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2007-12-13 14:52 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wootalyzer]
–a—— 2008-06-27 18:07 392192 c:\program files\Wootalyzer\woot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
–a—— 2007-08-20 16:03 110592 c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SlingAgentService"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"MDM"=2 (0x2)
"LVPrcSrv"=2 (0x2)
"LVCOMSer"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"CVPND"=2 (0x2)
"NBService"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\explorer.exe"=

S3 Razerlow;Diamondback 3G USB Filter Driver;c:\windows\system32\Drivers\DB3G.sys [2008-12-24 13225]
S4 SlingAgentService;SlingAgent Service;"c:\program files\Sling Media\SlingAgent\SlingAgentService.exe" [2008-09-21 93960]
.
Contents of the 'Scheduled Tasks' folder

2008-12-26 c:\windows\Tasks\pxbtllar.job
- c:\windows\system32\rundll32.exe [2007-08-20 16:16]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jay Berdia\Application Data\Mozilla\Firefox\Profiles\vasvv8a9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-26 19:38:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Razer\Diamondback 3G\razerofa.exe
.
**************************************************************************
.
Completion time: 2008-12-26 19:41:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-27 01:40:50

Pre-Run: 20,714,799,104 bytes free
Post-Run: 20,654,174,208 bytes free

183 — E O F — 2008-12-19 03:21:35

Hijack This:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:47:08 PM, on 12/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Razer\Diamondback 3G\razerhid.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Razer\Diamondback 3G\razerofa.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {607af8d1-d87b-4870-82c4-212a2c5aaad5} - C:\WINDOWS\system32\gezimihe.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback 3G\razerhid.exe
O4 - HKLM\..\Run: [kegibafari] Rundll32.exe "C:\WINDOWS\system32\hofalobu.dll",s
O4 - HKCU\..\Run: [Wootalyzer] C:\Program Files\Wootalyzer\woot.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\magohupa.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 3391 bytes
Post #4
Hi monkeyboy669,

Please do the following….

OTMoveIt3 by OldTimer

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy everything inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
c:\windows\Tasks\pxbtllar.job
c:\windows\system32\mkpzvpfx.zqm
c:\windows\wininit.ini
c:\windows\system32\bdod.bin
c:\windows\system32\gezimihe.dll
c:\windows\system32\hofalobu.dll
:Reg
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{607af8d1-d87b-4870-82c4-212a2c5aaad5}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kegibafari"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):"msv1_0"
:Commands
[purity]
[emptytemp]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

===========================================================


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

===========================================================

Needed in your next reply:

OTMoveIt3 log
Malwarebytes log

And let me know how things are running now :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI