virus won't let me open malware or go on ne virus removal related sites HELP !!

Question

Jer3mytmz 0 Newbie Poster

15 Years Ago

virus won't let me open malware or go on any virus removal related sites HELP !!

my Firefox is running extremely slow on and off spikes
my avg is not updating
malware wont open
every time i try to go on a site to dl something to help it will not even load

i look up system32 and latest "modified" dll was this tyshb36rfjdf.dll
plz help me this is really frustrating

windows-virus

5 Contributors
37 Replies
1K Views
1 Week Discussion Span
Latest Post 15 Years Ago Latest Post by crunchie

All 37 Replies

crunchie 990 Most Valuable Poster

15 Years Ago

Hi and welcome to Daniweb :).

Try doing a system search for any files starting with TDSS and delete them.
If found and deleted, try running those programs now.

cohen 17 Practically a Posting Shark

15 Years Ago

Try using internet explorer.

Cohen

Jer3mytmz commented: great help ! +1

crunchie 990 Most Valuable Poster

15 Years Ago

Did you install the keylogger program?

You need to do a full scan, not a quick scan.

Jer3mytmz commented: GREAT HELP ! +1

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Jer3mytmz 0 Newbie Poster · Answer 1 · 2008-12-18T11:41:34+00:00

Ok i will search right now my browser is extremely slow every time i refresh this so bare with me i appreciate your help a lot

Jer3mytmz 0 Newbie Poster · Answer 2 · 2008-12-18T11:42:30+00:00

no i also searched in hidden files and no TDSS showed up

Jer3mytmz 0 Newbie Poster · Answer 3 · 2008-12-18T11:58:11+00:00

Jer3mytmz 0 Newbie Poster

15 Years Ago

what should i do now ? =\

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2008-12-18T11:59:41+00:00

Some of the files are probably hidden, so unhide them in Folder Options.

Open Device Manager and in the VIEW Tab, put a tick next to show hidden devices.
Under non-plug and play drivers, search for TDSSserv and stop it if found.

Jer3mytmz 0 Newbie Poster · Answer 5 · 2008-12-18T12:04:36+00:00

ok i found it and i disabled it but it saids restart my computer should i restart it ?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2008-12-18T12:10:41+00:00

No, leave pc on as long as you have it disabled.

Can you run any of those tools now? I take it you have malwarebytes antimalware? If so, try running it and update it. Run a full scan and delete everything found.

Reboot your pc and post the MBAM log showing the items deleted.

Post an hijackthis log too.

Jer3mytmz 0 Newbie Poster · Answer 7 · 2008-12-18T12:21:00+00:00

yes i have malware antimalware but it still wont open the TDSSERV is disabled but nothin opens what should i do now ?

cohen 17 Practically a Posting Shark Featured Poster · Answer 8 · 2008-12-18T12:24:32+00:00

Hello,

Alright, let's try combo fix.

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please post that log in a reply.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Thanks,

Cohen

Jer3mytmz 0 Newbie Poster · Answer 9 · 2008-12-18T12:34:09+00:00

Jer3mytmz 0 Newbie Poster

15 Years Ago

i tried those 2 links it will not let me open

cohen 17 Practically a Posting Shark Featured Poster · Answer 10 · 2008-12-18T12:44:54+00:00

Alright, download it from here.

Continue my instructions as posted previously.

Thanks,

Cohen

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 11 · 2008-12-18T13:10:31+00:00

When you click on the link to download and the popup asking to save the file, change the name of combofix to combifix or some such and try and download it.

Jer3mytmz 0 Newbie Poster · Answer 12 · 2008-12-18T13:14:41+00:00

it didnit open after i double clicked it .. wow this shit is insane i never delt with a virus like this what should i do ?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 13 · 2008-12-18T13:20:34+00:00

crunchie 990 Most Valuable Poster

15 Years Ago

Did you try what I suggested above?

Jer3mytmz 0 Newbie Poster · Answer 14 · 2008-12-18T13:38:06+00:00

i didnt work i tried internet explorer changed the name but when it goes to the winrar its still combofix.

Jer3mytmz 0 Newbie Poster · Answer 15 · 2008-12-18T13:50:41+00:00

it worked but i needed to restart first after i disabled the TDSS

heres the log

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\inetget2
c:\program files\Mjcore
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\FT62
c:\temp\FT62\teTU.log
c:\windows\system32\dPI19
c:\windows\system32\Drivers\TDSSmqlt.sys
c:\windows\system32\TDSShrxr.dll
c:\windows\system32\TDSSkkbi.log
c:\windows\system32\TDSSlrvd.dat
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSoiqt.dll
c:\windows\system32\TDSSrtqp.dll
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.

2008-12-17 00:05 . 2008-12-17 00:05 15,000 --a--c--- c:\windows\system32\tyshb36rfjdf.dll
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\program files\iTunes
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\program files\iPod
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-30 14:39 . 2008-11-30 14:39 <DIR> d----c--- c:\documents and settings\All Users\Application Data\acccore
2008-11-20 21:49 . 2008-11-20 22:00 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\Twain
2008-11-20 21:44 . 2008-11-20 22:00 <DIR> d----c--- c:\program files\Webtools
2008-11-19 21:28 . 2008-11-19 22:13 889,918 --ahsc--- c:\windows\system32\QBayHkkj.ini
2008-11-19 21:28 . 2008-11-19 22:13 889,740 --ahsc--- c:\windows\system32\QBayHkkj.ini2
2008-11-19 21:27 . 2008-12-18 02:43 <DIR> d--h-c--- C:\$AVG8.VAULT$
2008-11-19 21:21 . 2008-12-16 17:47 <DIR> d----c--- c:\windows\system32\drivers\Avg
2008-11-19 21:21 . 2008-11-19 21:21 <DIR> d----c--- c:\program files\AVG
2008-11-19 21:21 . 2008-11-20 01:15 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\AVGTOOLBAR
2008-11-19 21:21 . 2008-12-17 00:18 <DIR> d----c--- c:\documents and settings\All Users\Application Data\avg8
2008-11-19 21:21 . 2008-11-19 21:21 97,928 --a--c--- c:\windows\system32\drivers\avgldx86.sys
2008-11-19 21:21 . 2008-11-19 21:21 76,040 --a--c--- c:\windows\system32\drivers\avgtdix.sys
2008-11-19 21:21 . 2008-11-19 21:21 10,520 --a--c--- c:\windows\system32\avgrsstx.dll
2008-11-19 21:19 . 2008-11-19 21:19 <DIR> d----c--- c:\windows\system32\avgfwdx.dll
2008-11-19 20:02 . 2008-11-19 20:02 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\IUpd721
2008-11-19 19:57 . 2008-12-17 00:19 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\NI.GSCNS
2008-11-19 19:49 . 2008-11-19 21:33 <DIR> d----c--- c:\windows\system32\vim
2008-11-19 19:49 . 2008-11-19 19:49 <DIR> d----c--- c:\windows\system32\hdx
2008-11-19 19:49 . 2008-11-19 21:32 <DIR> d----c--- c:\windows\system32\fip
2008-11-19 19:49 . 2008-11-19 21:30 <DIR> d----c--- c:\windows\system32\d
2008-11-19 19:49 . 2008-11-19 22:00 <DIR> d--hsc--- c:\windows\amVyM215
2008-11-19 19:49 . 2008-12-17 18:49 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\gadcom
2008-11-19 19:49 . 2008-11-19 19:49 90,915 --a--c--- c:\windows\system32\drzcetfoclf.dll-uninst.exe
2008-11-19 19:49 . 2008-11-19 19:49 79,094 --a--c--- c:\windows\system32\ytvgjtncgl.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 07:43 --------- dc--a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-18 05:14 --------- dc----w c:\program files\Malwarebytes' Anti-Malware
2008-12-18 04:43 --------- dc----w c:\program files\Warcraft III
2008-12-17 05:05 --------- dc----w c:\documents and settings\jer3my\Application Data\LimeWire
2008-12-16 05:23 --------- dc----w c:\program files\Common Files\Apple
2008-12-16 05:21 --------- dc----w c:\program files\QuickTime
2008-12-16 01:58 --------- dc----w c:\program files\Steam
2008-11-30 19:40 --------- dc----w c:\program files\AIM6
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-20 02:56 --------- dc----w c:\program files\Realtime-Spy
2008-11-20 02:55 --------- dc----w c:\program files\HomeKeylogger
2008-11-13 19:43 --------- dc----w c:\program files\DivX
2008-11-05 05:28 --------- dc----w c:\program files\Bonjour
2008-11-05 05:07 --------- dc----w c:\program files\Apple Software Update
2008-10-24 11:10 453,632 -c--a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 01:51 27 -c--a-w c:\documents and settings\All Users\Application Data\sneopts.dat
2008-10-24 01:36 --------- dc-h--w c:\documents and settings\All Users\Application Data\sacache
2008-10-23 16:26 112,839 -c-ha-w c:\windows\test.tmp
2008-10-23 16:13 277,282 -c--a-w c:\windows\drsetup.exe
2008-10-23 16:13 --------- dc----w c:\program files\WinConfig
2008-10-23 13:01 283,648 -c--a-w c:\windows\system32\gdi32.dll
2008-10-22 21:10 38,496 -c--a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 21:10 15,504 -c--a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 19:13 202,776 -c--a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 -c--a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 -c--a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 -c--a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 -c--a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 -c--a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 -c--a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 -c--a-w c:\windows\system32\wups.dll
2008-10-16 10:20 667,648 -c--a-w c:\windows\system32\wininet.dll
2008-10-03 10:15 247,326 -c--a-w c:\windows\system32\strmdll.dll
2008-09-30 21:43 1,286,152 -c--a-w c:\windows\system32\msxml4.dll
2008-09-19 21:55 200,704 -c--a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 -c--a-w c:\windows\system32\libdivx.dll
2008-09-16 00:16 2,344 -c--a-w c:\documents and settings\jer3my\Application Data\wklnhst.dat
2007-11-28 23:53 60,968 -c--a-w c:\documents and settings\jer3my\GoToAssistDownloadHelper.exe
2007-11-19 17:17 439,296 -c--a-w c:\documents and settings\jer3my\GoToAssist_phone__317_en.exe
2007-08-03 23:36 8,784 -c--a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-08-03 22:03 245,408 -c--a-w c:\program files\mozilla firefox\plugins\unicows.dll
2005-07-29 21:24 472 -csha-r c:\windows\amVyM215\uApVgZYc.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5BF49A2-94F1-42BD-F434-3604812C807D}]
2008-12-17 00:05 15000 --a--c--- c:\windows\system32\tyshb36rfjdf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"jsf8j34rgfght"="c:\docume~1\jer3my\LOCALS~1\Temp\winloggn.exe" [2008-12-17 15000]
"Jnskdfmf9eldfd"="c:\docume~1\jer3my\LOCALS~1\Temp\csrssc.exe" [2008-12-18 21505]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2002-05-18 327680]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-30 185632]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"Adobe_ID0EYTHM"="c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-06-27 91432]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"jsf8j34rgfght"="c:\docume~1\jer3my\LOCALS~1\Temp\winloggn.exe" [2008-12-17 15000]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2007-10-04 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dell Network Assistant.lnk - c:\windows\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2007-11-15 7168]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-03-21 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{D5BF49A2-94F1-42BD-F434-3604812C807D}"= "c:\windows\system32\tyshb36rfjdf.dll" [2008-12-17 15000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2007-11-28 18:53 10792 c:\program files\Citrix\GoToAssist\480\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\jkkHyaBQ

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\jeremyzeng\\counter-strike\\hl.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\ijji\\ENGLISH\\u_gbound.exe"=
"c:\\ijji\\ENGLISH\\Gunbound Revolution\\GunBound.gme"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
"6112:TCP"= 6112:TCP:warcraft
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-19 97928]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};\??\c:\program files\CyberLink\PowerDVD8\000.fcl [2008-06-27 15:50:32 61424]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-19 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-19 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-19 76040]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-19 24652]
R3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2004-08-10 12672]
S3 GoToAssist;GoToAssist;"c:\program files\Citrix\GoToAssist\480\g2aservice.exe" Start=service [2007-11-28 16936]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2003-06-13 30336]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6bdc2830-6822-11dd-b4c5-001aa09c90b4}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe097f73-d999-11dc-b38a-001aa09c90b4}]
\Shell\Explore\command - explorer.exe /n,/e ,.
\Shell\Launch\command - E:\portablevaultaes.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-vvmozoeripagcm - c:\windows\system32\pgljxhnxxmo.dll

.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=482Os1q0mRtrn-wV2_mG8Z5Wqwg
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exe
IE: {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - c:\program files\Verizon Online\ControlPad\Misc\a_menu.exe -
IE: {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FireFox -: Profile - c:\documents and settings\jer3my\Application Data\Mozilla\Firefox\Profiles\85zviy1o.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF -: plugin - c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-18 02:45:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSmqlt.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)
c:\windows\system32\avgrsstx.dll
c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll

- - - - - - - > 'lsass.exe'(1024)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2008-12-18 2:47:45
ComboFix-quarantined-files.txt 2008-12-18 07:46:27

Pre-Run: 113,611,702,272 bytes free
Post-Run: 113,712,852,992 bytes free

269 --- E O F --- 2008-12-10 05:43:59

Jer3mytmz 0 Newbie Poster · Answer 16 · 2008-12-18T13:59:02+00:00

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 2

12/18/2008 2:57:35 AM
mbam-log-2008-12-18 (02-57-35).txt

Scan type: Quick Scan
Objects scanned: 47323
Time elapsed: 6 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.VirusRemover) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusremover2008 (Rogue.VirusRemove) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8j34rgfght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8j34rgfght (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Webtools (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\tyshb36rfjdf.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\Documents and Settings\jer3my\Local Settings\Temp\winloggn.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\jer3my\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Delete on reboot.

cohen 17 Practically a Posting Shark Featured Poster · Answer 17 · 2008-12-18T14:16:57+00:00

Alright,

Can you pls update your MBA-M, update it under the update tab, it should be database 1512 or higher. Then pls run a scan again.

Then, download Hijackthis, run a scan and post the log.

Thanks,

Cohen

Jer3mytmz 0 Newbie Poster · Answer 18 · 2008-12-18T14:21:30+00:00

i am doin the update right now and scannin then ill do the hijackthis

Jer3mytmz 0 Newbie Poster · Answer 19 · 2008-12-18T14:22:01+00:00

Malwarebytes' Anti-Malware 1.31
Database version: 1512
Windows 5.1.2600 Service Pack 2

12/18/2008 3:21:38 AM
mbam-log-2008-12-18 (03-21-38).txt

Scan type: Quick Scan
Objects scanned: 50665
Time elapsed: 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{e486fdb9-5d63-9ae2-7a78-0030503a1950} (Adware.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\jer3my\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jer3my\Application Data\NI.GSCNS (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\drzcetfoclf.dll-uninst.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jer3my\Application Data\gadcom\gadcom.exe7o2 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jer3my\Application Data\NI.GSCNS\dl.ini (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\jer3my\Application Data\NI.GSCNS\settings.ini (Trojan.Agent) -> Quarantined and deleted successfully.

Jer3mytmz 0 Newbie Poster · Answer 20 · 2008-12-18T14:23:39+00:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:22:54 AM, on 12/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\jer3my\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2071115
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=482Os1q0mRtrn-wV2_mG8Z5Wqwg
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\jer3my\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FC36121-1FD9-4F4C-8FEE-51587F3E5D67}: NameServer = 68.237.161.12 71.250.0.12
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 10577 bytes

Jer3mytmz 0 Newbie Poster · Answer 21 · 2008-12-18T14:24:57+00:00

Jer3mytmz 0 Newbie Poster

15 Years Ago

yeah i did

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 22 · 2008-12-18T14:32:20+00:00

You need to do the full scan with MBAM.

You never rebooted after running MBAM either. Please do so.

==

You need to post the entire combofix log too.

==

1. Please open Notepad Click Start , then Run
Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::



File::

c:\windows\system32\QBayHkkj.ini

c:\windows\system32\QBayHkkj.ini2

c:\windows\system32\ytvgjtncgl.exe

c:\windows\system32\TDSSserv



Driver::

TDSSserv

TDSSmqlt



Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"jsf8j34rgfght"=-

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{D5BF49A2-94F1-42BD-F434-3604812C807D}"=-

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter youre-enable all the programs that were disabled during the running of ComboFix:Combofix.txt
A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Jer3mytmz 0 Newbie Poster · Answer 23 · 2008-12-18T15:01:42+00:00

ComboFix 08-12-07.04 - jer3my 2008-12-18 3:52:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2464 [GMT -5:00]
Running from: c:\documents and settings\jer3my\Desktop\fixcomb.exe
Command switches used :: c:\documents and settings\jer3my\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
c:\windows\system32\QBayHkkj.ini
c:\windows\system32\QBayHkkj.ini2
c:\windows\system32\TDSSserv
c:\windows\system32\ytvgjtncgl.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\QBayHkkj.ini
c:\windows\system32\QBayHkkj.ini2
c:\windows\system32\ytvgjtncgl.exe

.
((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.

2008-12-18 03:22 . 2008-12-18 03:22 <DIR> d----c--- c:\program files\Trend Micro
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\program files\iTunes
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\program files\iPod
2008-12-16 00:23 . 2008-12-16 00:23 <DIR> d----c--- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-30 14:39 . 2008-11-30 14:39 <DIR> d----c--- c:\documents and settings\All Users\Application Data\acccore
2008-11-20 21:49 . 2008-11-20 22:00 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\Twain
2008-11-19 21:27 . 2008-12-18 02:46 <DIR> d--h-c--- C:\$AVG8.VAULT$
2008-11-19 21:21 . 2008-12-18 02:49 <DIR> d----c--- c:\windows\system32\drivers\Avg
2008-11-19 21:21 . 2008-11-19 21:21 <DIR> d----c--- c:\program files\AVG
2008-11-19 21:21 . 2008-11-20 01:15 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\AVGTOOLBAR
2008-11-19 21:21 . 2008-12-17 00:18 <DIR> d----c--- c:\documents and settings\All Users\Application Data\avg8
2008-11-19 21:21 . 2008-11-19 21:21 97,928 --a--c--- c:\windows\system32\drivers\avgldx86.sys
2008-11-19 21:21 . 2008-11-19 21:21 76,040 --a--c--- c:\windows\system32\drivers\avgtdix.sys
2008-11-19 21:21 . 2008-11-19 21:21 10,520 --a--c--- c:\windows\system32\avgrsstx.dll
2008-11-19 21:19 . 2008-11-19 21:19 <DIR> d----c--- c:\windows\system32\avgfwdx.dll
2008-11-19 20:02 . 2008-11-19 20:02 <DIR> d----c--- c:\documents and settings\jer3my\Application Data\IUpd721
2008-11-19 19:49 . 2008-11-19 21:33 <DIR> d----c--- c:\windows\system32\vim
2008-11-19 19:49 . 2008-11-19 19:49 <DIR> d----c--- c:\windows\system32\hdx
2008-11-19 19:49 . 2008-11-19 21:32 <DIR> d----c--- c:\windows\system32\fip
2008-11-19 19:49 . 2008-11-19 21:30 <DIR> d----c--- c:\windows\system32\d
2008-11-19 19:49 . 2008-11-19 22:00 <DIR> d--hsc--- c:\windows\amVyM215

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-18 08:20 --------- dc----w c:\program files\Malwarebytes' Anti-Malware
2008-12-18 08:13 --------- dc----w c:\program files\Steam
2008-12-18 08:08 --------- dc--a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-18 04:43 --------- dc----w c:\program files\Warcraft III
2008-12-17 05:05 --------- dc----w c:\documents and settings\jer3my\Application Data\LimeWire
2008-12-16 05:23 --------- dc----w c:\program files\Common Files\Apple
2008-12-16 05:21 --------- dc----w c:\program files\QuickTime
2008-12-04 00:52 38,496 -c--a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 00:52 15,504 -c--a-w c:\windows\system32\drivers\mbam.sys
2008-11-30 19:40 --------- dc----w c:\program files\AIM6
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-30 19:39 --------- dc----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-20 02:56 --------- dc----w c:\program files\Realtime-Spy
2008-11-20 02:55 --------- dc----w c:\program files\HomeKeylogger
2008-11-13 19:43 --------- dc----w c:\program files\DivX
2008-11-05 05:28 --------- dc----w c:\program files\Bonjour
2008-11-05 05:07 --------- dc----w c:\program files\Apple Software Update
2008-10-24 11:10 453,632 -c--a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 01:51 27 -c--a-w c:\documents and settings\All Users\Application Data\sneopts.dat
2008-10-24 01:36 --------- dc-h--w c:\documents and settings\All Users\Application Data\sacache
2008-10-23 16:26 112,839 -c-ha-w c:\windows\test.tmp
2008-10-23 16:13 277,282 -c--a-w c:\windows\drsetup.exe
2008-10-23 16:13 --------- dc----w c:\program files\WinConfig
2008-09-16 00:16 2,344 -c--a-w c:\documents and settings\jer3my\Application Data\wklnhst.dat
2007-11-28 23:53 60,968 -c--a-w c:\documents and settings\jer3my\GoToAssistDownloadHelper.exe
2007-11-19 17:17 439,296 -c--a-w c:\documents and settings\jer3my\GoToAssist_phone__317_en.exe
2007-08-03 23:36 8,784 -c--a-w c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2007-08-03 22:03 245,408 -c--a-w c:\program files\mozilla firefox\plugins\unicows.dll
2005-07-29 21:24 472 -csha-r c:\windows\amVyM215\uApVgZYc.vbs
.

((((((((((((((((((((((((((((( snapshot@2008-12-18_ 2.45.51.81 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-16 10:20:56 3,067,392 -c--a-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-12 17:27:54 3,067,392 -c--a-w c:\windows\system32\dllcache\mshtml.dll
- 2008-10-16 10:20:56 3,067,392 -c--a-w c:\windows\system32\mshtml.dll
+ 2008-12-12 17:27:54 3,067,392 -c--a-w c:\windows\system32\mshtml.dll
- 2007-07-27 14:41:40 16,760 -c----w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 -c----w c:\windows\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 2321600]
"Google Update"="c:\documents and settings\jer3my\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-18 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"Motive SmartBridge"="c:\progra~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe" [2002-05-18 327680]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-30 185632]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"Adobe_ID0EYTHM"="c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-06-27 91432]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2008-12-03 1265296]
"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2007-10-04 c:\windows\system32\nwiz.exe]