virus won't let me open malware or go on ne virus removal related sites HELP !!

[Jer3mytmz]

virus won't let me open malware or go on any virus removal related sites HELP !!

my Firefox is running extremely slow on and off spikes
my avg is not updating
malware wont open
every time i try to go on a site to dl something to help it will not even load

i look up system32 and latest "modified" dll was this tyshb36rfjdf.dll
plz help me this is really frustrating

[crunchie]

Hi and welcome to Daniweb :).

Try doing a system search for any files starting with TDSS and delete them.
If found and deleted, try running those programs now.

[Jer3mytmz]

Ok i will search right now my browser is extremely slow every time i refresh this so bare with me i appreciate your help a lot

[Jer3mytmz]

no i also searched in hidden files and no TDSS showed up

[Jer3mytmz]

what should i do now ? =\

[crunchie]

Some of the files are probably hidden, so unhide them in Folder Options.

Open Device Manager and in the VIEW Tab, put a tick next to show hidden devices.
Under non-plug and play drivers, search for TDSSserv and stop it if found.

[Jer3mytmz]

ok i found it and i disabled it but it saids restart my computer should i restart it ?

[crunchie]

No, leave pc on as long as you have it disabled.

Can you run any of those tools now? I take it you have malwarebytes antimalware? If so, try running it and update it. Run a full scan and delete everything found.

Reboot your pc and post the MBAM log showing the items deleted.

Post an hijackthis log too.

[Jer3mytmz]

yes i have malware antimalware but it still wont open the TDSSERV is disabled but nothin opens what should i do now ?

[cohen]

Hello,

Alright, let's try combo fix.

Please download ComboFix by sUBs from HERE or HERE You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please post that log in a reply.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Thanks,

Cohen

[Jer3mytmz]

i tried those 2 links it will not let me open

[cohen]

Alright, download it from here .

Continue my instructions as posted previously.

Thanks,

Cohen

[crunchie]

When you click on the link to download and the popup asking to save the file, change the name of combofix to combifix or some such and try and download it.

[Jer3mytmz]

it didnit open after i double clicked it .. wow this shit is insane i never delt with a virus like this what should i do ?

[crunchie]

Did you try what I suggested above?

[cohen]

Try using internet explorer.

Cohen

[Jer3mytmz]

i didnt work i tried internet explorer changed the name but when it goes to the winrar its still combofix.

[Jer3mytmz]

it worked but i needed to restart first after i disabled the TDSS

heres the log

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\inetget2
c:\program files\Mjcore
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\FT62
c:\temp\FT62\teTU.log
c:\windows\system32\dPI19
c:\windows\system32\Drivers\TDSSmqlt.sys
c:\windows\system32\TDSShrxr.dll
c:\windows\system32\TDSSkkbi.log
c:\windows\system32\TDSSlrvd.dat
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSoiqt.dll
c:\windows\system32\TDSSrtqp.dll
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.

2008-12-17 00:05 . 2008-12-17 00:05 15,000 --a--c--- c:\windows\system32\tyshb36rfjdf.dll
2008-12-16 00:23 . 2008-12-16 00:23 d----c--- c:\program files\iTunes
2008-12-16 00:23 . 2008-12-16 00:23 d----c--- c:\program files\iPod
2008-12-16 00:23 . 2008-12-16 00:23 d----c--- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-30 14:39 . 2008-11-30 14:39 d----c--- c:\documents and settings\All Users\Application Data\acccore
2008-11-20 21:49 . 2008-11-20 22:00 d----c--- c:\documents and settings\jer3my\Application Data\Twain
2008-11-20 21:44 . 2008-11-20 22:00 d----c--- c:\program files\Webtools
2008-11-19 21:28 . 2008-11-19 22:13 889,918 --ahsc--- c:\windows\system32\QBayHkkj.ini
2008-11-19 21:28 . 2008-11-19 22:13 889,740 --ahsc--- c:\windows\system32\QBayHkkj.ini2
2008-11-19 21:27 . 2008-12-18 02:43 d--h-c--- C:\$AVG8.VAULT$
2008-11-19 21:21 . 2008-12-16 17:47 d----c--- c:\windows\system32\drivers\Avg
2008-11-19 21:21 . 2008-11-19 21:21 d----c--- c:\program files\AVG
2008-11-19 21:21 . 2008-11-20 01:15 d----c--- c:\documents and settings\jer3my\Application Data\AVGTOOLBAR
2008-11-19 21:21 . 2008-12-17 00:18 d----c--- c:\documents and settings\All Users\Application Data\avg8
2008-11-19 21:21 . 2008-11-19 21:21 97,928 --a--c--- c:\windows\system32\drivers\avgldx86.sys
2008-11-19 21:21 . 2008-11-19 21:21 76,040 --a--c--- c:\windows\system32\drivers\avgtdix.sys
2008-11-19 21:21 . 2008-11-19 21:21 10,520 --a--c--- c:\windows\system32\avgrsstx.dll
2008-11-19 21:19 . 2008-11-19 21:19 d----c--- c:\windows\system32\avgfwdx.dll
2008-11-19 20:02 . 2008-11-19 20:02 d----c--- c:\documents and settings\jer3my\Application Data\IUpd721
2008-11-19 19:57 . 2008-12-17 00:19 d----c--- c:\documents and settings\jer3my\Application Data\NI.GSCNS
2008-11-19 19:49 . 2008-11-19 21:33 d----c--- c:\windows\system32\vim
2008-11-19 19:49 . 2008-11-19 19:49 d----c--- c:\windows\system32\hdx
2008-11-19 19:49 . 2008-11-19 21:32 d----c--- c:\windows\system32\fip
2008-11-19 19:49 . 2008-11-19 21:30 d----c--- c:\windows\system32\d
2008-11-19 19:49 . 2008-11-19 22:00 d--hsc--- c:\windows\amVyM215
2008-11-19 19:49 . 2008-12-17 18:49 d----c--- c:\documents and settings\jer3my\Application Data\gadcom
2008-11-19 19:49 . 2008-11-19 19:49 90,915 --a--c--- c:\windows\system32\drzcetfoclf.dll-uninst.exe
2008-11-19 19:49 . 2008-11-19 19:49 79,094 --a--c--- c:\windows\system32\ytvgjtncgl.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 07:43 --------- dc--a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-18 05:14 --------- dc----w c:\program files\Malwarebytes' Anti-Malware
2008-12-18 04:43 --------- dc----w c:\program files\Warcraft III
2008-12-17 05:05 --------- dc----w c:\documents and settings\jer3my\Application Data\LimeWire
2008-12-16 05:23 --------- dc----w c:\program files\Common Files\Apple
2008-12-16 05:21 --------- dc----w c:\program files\QuickTime
2008-12-16 01:58 --------- dc----w c:\program files\Steam
2008-11-30 19:40 --------- dc----w c:\program files\AIM6
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-20 02:56 --------- dc----w c:\program files\Realtime-Spy
2008-11-20 02:55 --------- dc----w c:\program files\HomeKeylogger
2008-11-13 19:43 --------- dc----w c:\program files\DivX
2008-11-05 05:28 --------- dc----w c:\program files\Bonjour
2008-11-05 05:07 --------- dc----w c:\program files\Apple Software Update
2008-10-24 11:10 453,632 -c--a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 01:51 27 -c--a-w c:\documents and settings\All Users\Application Data\sneopts.dat
2008-10-24 01:36 --------- dc-h--w c:\documents and settings\All Users\Application Data\sacache
2008-10-23 16:26 112,839 -c-ha-w c:\windows\test.tmp
2008-10-23 16:13 277,282 -c--a-w c:\windows\drsetup.exe
2008-10-23 16:13 --------- dc----w c:\program files\WinConfig
2008-10-23 13:01 283,648 -c--a-w c:\windows\system32\gdi32.dll
2008-10-22 21:10 38,496 -c--a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 21:10 15,504 -c--a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 19:13 202,776 -c--a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 -c--a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 -c--a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 -c--a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 -c--a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 -c--a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 -c--a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 -c--a-w c:\windows\system32\wups.dll
2008-10-16 10:20 667,648 -c--a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 -c--a-w c:\windows\system32\strmdll.dll
2008-09-30 21:43 1,286,152 -c--a-w c:\windows\system32\msxml4.dll
2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll
2008-09-16 00:16 2,344 -c--a-w c:\documents and settings\jer3my\Application Data\wklnhst.dat
2007-11-28 23:53 60,968 -c--a-w c:\documents and settings\jer3my\GoToAssistDownloadHelper.exe
2007-11-19 17:17 439,296 -c--a-w c:\documents and settings\jer3my\GoToAssist_phone__317_en.exe
2007-08-03 23:36 8,784 -c--a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-08-03 22:03 245,408 -c--a-w c:\program files\mozilla firefox\plugins\unicows.dll
2005-07-29 21:24 472 -csha-r c:\windows\amVyM215\uApVgZYc.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5BF49A2-94F1-42BD-F434-3604812C807D}]
2008-12-17 00:05 15000 --a--c--- c:\windows\system32\tyshb36rfjdf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"jsf8j34rgfght"="c:\docume~1\jer3my\LOCALS~1\Temp\winloggn.exe" [2008-12-17 15000]
"Jnskdfmf9eldfd"="c:\docume~1\jer3my\LOCALS~1\Temp\csrssc.exe" [2008-12-18 21505]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2002-05-18 327680]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-30 185632]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"Adobe_ID0EYTHM"="c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-06-27 91432]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"jsf8j34rgfght"="c:\docume~1\jer3my\LOCALS~1\Temp\winloggn.exe" [2008-12-17 15000]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2007-10-04 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2007-11-15 7168]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-03-21 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{D5BF49A2-94F1-42BD-F434-3604812C807D}"= "c:\windows\system32\tyshb36rfjdf.dll" [2008-12-17 15000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2007-11-28 18:53 10792 c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\jkkHyaBQ

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\jeremyzeng\\counter-strike\\hl.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\ijji\\ENGLISH\\u_gbound.exe"=
"c:\\ijji\\ENGLISH\\Gunbound Revolution\\GunBound.gme"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"6112:TCP"= 6112:TCP:warcraft
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-19 97928]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};\??\c:\program files\CyberLink\PowerDVD8\000.fcl [2008-06-27 15:50:32 61424]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-19 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-19 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-19 76040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-19 24652]
R3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2004-08-10 12672]
S3 GoToAssist;GoToAssist;"c:\program files\Citrix\GoToAssist\480\g2aservice.exe" Start=service [2007-11-28 16936]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2003-06-13 30336]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6bdc2830-6822-11dd-b4c5-001aa09c90b4}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe097f73-d999-11dc-b38a-001aa09c90b4}]
\Shell\Explore\command - explorer.exe /n,/e ,.
\Shell\Launch\command - E:\portablevaultaes.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-vvmozoeripagcm - c:\windows\system32\pgljxhnxxmo.dll

.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/* http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=482Os1q0mRtrn-wV2_mG8Z5Wqwg
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/* http://www.yahoo.com
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exe
IE: {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exe -
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FireFox -: Profile - c:\documents and settings\jer3my\Application Data\Mozilla\Firefox\Profiles\85zviy1o.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-18 02:45:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSmqlt.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\avgrsstx.dll
c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll

- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2008-12-18 2:47:45
ComboFix-quarantined-files.txt 2008-12-18 07:46:27

Pre-Run: 113,611,702,272 bytes free
Post-Run: 113,712,852,992 bytes free

269 --- E O F --- 2008-12-10 05:43:59

[Jer3mytmz]

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 2

12/18/2008 2:57:35 AM
mbam-log-2008-12-18 (02-57-35).txt

Scan type: Quick Scan
Objects scanned: 47323
Time elapsed: 6 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8j34rgfght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8j34rgfght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Webtools (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\tyshb36rfjdf.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\Documents and Settings\jer3my\Local Settings\Temp\winloggn.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\jer3my\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Delete on reboot.

[cohen]

Alright,

Can you pls update your MBA-M, update it under the update tab, it should be database 1512 or higher. Then pls run a scan again.

Then, download Hijackthis , run a scan and post the log.

Thanks,

Cohen