We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

A little help please.

carrie483
carrie483 Posts: 1,868 Forumite
in Techie Stuff
Hi, I had a trojan horse virus get through my firewall on a google update file, thankfully AVG picked it up and apparently deleted it and then i scanned again and it found it attached to a system32 file. I believe AVG has got rid of both of these but my computer is suffering now.

I'm getting loads of pop ups and my computer keeps restarting and then on start up i get a 'your computer has recovered from a serious error' message. I'm generally ok with my computer but there are a few suspicious looking things on my hijack this log. I'm not confident enough to just start fixing random files so can someone tell me if there is an issue at all please.

Many Thanks. Carrie.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:53:59, on 19/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0fd483ee-0525-4d03-8c19-a2ef624c4b66} - C:\WINDOWS\system32\ketedoti.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [wizanabuhi] Rundll32.exe "C:\WINDOWS\system32\tepidike.dll",s
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [738eb34d] rundll32.exe "C:\WINDOWS\system32\biyedepu.dll",b
O4 - HKLM\..\Run: [CPM70bd80d1] Rundll32.exe "c:\windows\system32\tudotipi.dll",a
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZK
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{2096E753-C77D-459F-B010-F8353A27F8EB}: NameServer = 194.168.4.100,194.168.8.100
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\yayosiyi.dll c:\windows\system32\tudotipi.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: yayyWqQj - yayyWqQj.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tudotipi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tudotipi.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10955 bytes
Accept that some days you're the pigeon and some days you're the statue.
«134

Comments

  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Download MALWAREBYTES (Make sure you click 'DOWNLOAD NOW')
    http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
    UPDATE and FULL SCAN
    Post the log here AFTER youve deleted everything it finds
    :idea:
  • carrie483
    carrie483 Posts: 1,868 Forumite
    Blimey :eek:

    Malwarebytes' Anti-Malware 1.36
    Database version: 2009
    Windows 5.1.2600 Service Pack 3

    19/04/2009 20:11:56
    mbam-log-2009-04-19 (20-11-56).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 223548
    Time elapsed: 2 hour(s), 3 minute(s), 27 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 5
    Registry Keys Infected: 32
    Registry Values Infected: 8
    Registry Data Items Infected: 6
    Folders Infected: 7
    Files Infected: 25

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\system32\biyedepu.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\tudotipi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\yayosiyi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\tepidike.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\ketedoti.dll (Trojan.Vundo.H) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fd483ee-0525-4d03-8c19-a2ef624c4b66} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{0fd483ee-0525-4d03-8c19-a2ef624c4b66} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0fd483ee-0525-4d03-8c19-a2ef624c4b66} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\cs41275 (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\738eb34d (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wizanabuhi (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm70bd80d1 (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\winlog (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlog (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\tudotipi.dll -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\yayosiyi.dll -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\yayosiyi.dll -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HP_Administrator\Application Data\FunWebProducts (Adware.MyWay) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HP_Administrator\Application Data\FunWebProducts\Data (Adware.MyWay) -> Quarantined and deleted successfully.
    C:\Documents and Settings\HP_Administrator\Application Data\FunWebProducts\Data\HP_Administrator (Adware.MyWay) -> Quarantined and deleted successfully.

    Files Infected:
    C:\WINDOWS\system32\biyedepu.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\upedeyib.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tepidike.dll (Trojan.Vundo.H) -> Delete on reboot.
    c:\WINDOWS\system32\tudotipi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\ketedoti.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\yayosiyi.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\System Volume Information\_restore{F7149EC7-4FA5-4148-81FA-2F7A6348FD9A}\RP485\A0237295.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F7149EC7-4FA5-4148-81FA-2F7A6348FD9A}\RP485\A0237296.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F7149EC7-4FA5-4148-81FA-2F7A6348FD9A}\RP485\A0237297.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F7149EC7-4FA5-4148-81FA-2F7A6348FD9A}\RP486\A0238282.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F7149EC7-4FA5-4148-81FA-2F7A6348FD9A}\RP486\A0238283.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\Fishdom\uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\kekasika.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\mebetewu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\muhoyawa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tukuhegu.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\bszip.dll (Worm.P2P) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\yisiwusu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\regedit.com (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\cmd.com (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ping.com (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\netstat.com (Worm.Alcra) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tasklist.com (Worm.Alcra) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tracert.com (Worm.Alcra) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\taskkill.com (Worm.P2P) -> Quarantined and deleted successfully.
    Accept that some days you're the pigeon and some days you're the statue.
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    You have both AVG AND AVAST running on your computer
    BAD idea
    Uninstall AVG then use the AVG REMOVAL TOOL
    http://www.avg.com/download-tools
    :idea:
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Then run COMBOFIX
    Follow the simple instructions it gives
    Post the ENTIRE log here please


    (I assume AVAST runs ok?)
    :idea:
  • carrie483
    carrie483 Posts: 1,868 Forumite
    Avast doesn't really seem to do anything, it runs fine and it scans but thats all it does. It appears my computer keeps having mini dumps too. Is that right that it wants me to disable avg and avast before running combofix?
    Accept that some days you're the pigeon and some days you're the statue.
  • thomas01155
    thomas01155 Posts: 2,382 Forumite
    Part of the Furniture 1,000 Posts Name Dropper Combo Breaker
    Yes, otherwise they will interfere with the scanner.
  • carrie483
    carrie483 Posts: 1,868 Forumite
    ComboFix 09-04-20.02 - HP_Administrator 19/04/2009 22:06.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.376 [GMT 1:00]
    Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
    AV: avast! antivirus 4.8.1335 [VPS 090419-0] *On-access scanning disabled* (Updated)
    AV: AVG Anti-Virus *On-access scanning enabled* (Updated)
    FW: Norton Internet Worm Protection *disabled*
    FW: ZoneAlarm Firewall *enabled*
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\outlook
    c:\windows\system32\_000006_.tmp.dll
    c:\windows\system32\_000007_.tmp.dll
    c:\windows\system32\_000010_.tmp.dll
    c:\windows\system32\inuholal.ini
    c:\windows\system32\uwahogup.ini
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 )))))))))))))))))))))))))))))))
    .

    2009-04-19 17:06 . 2009-04-19 17:06
    d
    w c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
    2009-04-19 17:06 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-04-19 17:06 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-04-19 17:06 . 2009-04-19 17:06
    d
    w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-04-19 17:05 . 2009-04-19 17:06
    d
    w c:\program files\Malwarebytes' Anti-Malware
    2009-04-19 09:30 . 2009-04-19 15:09
    dc-h--w c:\documents and settings\All Users\Application Data\~0
    2009-04-19 09:29 . 2009-04-19 15:09
    d
    w c:\documents and settings\All Users\Application Data\Lavasoft
    2009-04-18 11:54 . 2009-04-18 11:54 10520 ----a-w c:\windows\system32\avgrsstx.dll
    2009-04-18 11:54 . 2009-04-18 11:54 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
    2009-04-18 11:54 . 2009-04-18 11:54 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
    2009-04-18 11:54 . 2009-04-18 11:54 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
    2009-04-18 11:54 . 2009-04-18 14:05
    d
    w c:\windows\system32\drivers\Avg
    2009-04-18 10:43 . 2009-04-18 10:43 1400633 --sh--w c:\windows\system32\uwahogup.tmp
    2009-04-16 17:54 . 2009-03-09 01:53 73728 ----a-w c:\windows\system32\javacpl.cpl
    2009-04-16 17:54 . 2009-03-09 04:19 410984 ----a-w c:\windows\system32\deploytk.dll
    2009-04-15 08:54 . 2009-03-06 14:22 284160
    w c:\windows\system32\dllcache\pdh.dll
    2009-04-15 08:54 . 2009-02-09 12:10 401408
    w c:\windows\system32\dllcache\rpcss.dll
    2009-04-15 08:54 . 2009-02-06 11:11 110592
    w c:\windows\system32\dllcache\services.exe
    2009-04-15 08:54 . 2009-02-09 12:10 729088
    w c:\windows\system32\dllcache\lsasrv.dll
    2009-04-15 08:54 . 2009-02-09 12:10 617472
    w c:\windows\system32\dllcache\advapi32.dll
    2009-04-15 08:54 . 2009-02-09 12:10 473600
    w c:\windows\system32\dllcache\fastprox.dll
    2009-04-15 08:54 . 2009-02-09 12:10 453120
    w c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-15 08:54 . 2009-02-06 10:10 227840
    w c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-15 08:54 . 2009-02-09 12:10 714752
    w c:\windows\system32\dllcache\ntdll.dll
    2009-04-15 08:53 . 2008-05-03 11:55 2560
    w c:\windows\system32\xpsp4res.dll
    2009-04-15 08:53 . 2009-03-27 06:58 1203922
    w c:\windows\system32\dllcache\sysmain.sdb
    2009-04-15 08:53 . 2008-04-21 12:08 215552
    w c:\windows\system32\dllcache\wordpad.exe
    2009-04-11 17:03 . 2009-04-11 17:03
    d
    w c:\program files\Bethesda Softworks
    2009-04-10 23:25 . 2009-04-10 23:25
    d
    w c:\program files\iPod
    2009-04-10 23:25 . 2009-04-10 23:25
    d
    w c:\program files\iTunes
    2009-04-10 23:25 . 2009-04-10 23:25
    d
    w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-04-10 23:23 . 2009-04-10 23:23
    d
    w c:\program files\Bonjour
    2009-04-10 23:18 . 2009-04-10 23:19
    d
    w c:\program files\Safari
    2009-04-06 15:27 . 2009-04-06 15:27
    d
    w c:\documents and settings\HP_Administrator\Application Data\Playrix Entertainment
    2009-04-06 14:26 . 2009-04-06 14:26
    d
    w c:\documents and settings\All Users\Application Data\HipSoft
    2009-04-06 14:26 . 2009-04-19 19:11
    d
    w c:\windows\Fishdom
    2009-04-06 14:26 . 2009-04-09 16:44
    d
    w c:\program files\Fishdom
    2009-04-04 03:04 . 2009-04-04 03:05
    d
    w c:\program files\Common Files\DivX Shared
    2009-03-28 19:11 . 2009-03-28 19:11
    d
    w c:\documents and settings\All Users\Application Data\NCH Software
    2009-03-28 19:10 . 2009-03-29 09:15
    d
    w c:\program files\NCH Software
    2009-03-28 19:10 . 2009-03-28 19:11
    d
    w c:\documents and settings\All Users\Application Data\NCH Swift Sound
    2009-03-28 19:10 . 2009-03-29 09:16
    d
    w c:\documents and settings\HP_Administrator\Application Data\NCH Swift Sound
    2009-03-27 10:02 . 2009-03-27 10:03
    d
    w c:\program files\AskBarDis
    2009-03-23 16:35 . 2009-03-23 16:35 4 ----a-w c:\windows\msoffice.ini
    2009-03-23 16:33 . 2009-03-23 16:35
    d
    w C:\CompuServe 2000a
    2009-03-23 16:23 . 1999-04-05 17:23 204331 ----a-w c:\windows\csunins.exe
    2009-03-23 16:23 . 1999-01-26 18:21 153088 ----a-w c:\windows\system32\jgdwmie.dll
    2009-03-22 17:10 . 2009-03-22 17:10
    d
    w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
    2009-03-22 17:10 . 2009-03-22 17:10
    d
    w c:\documents and settings\HP_Administrator\Application Data\GameHouse
    2009-03-21 23:49 . 2009-03-21 23:49
    d
    w c:\documents and settings\All Users\Application Data\Trymedia
    2009-03-21 23:49 . 2009-03-22 00:50
    d
    w C:\GameHouse Games
    2009-03-21 23:48 . 2009-03-22 00:50
    d
    w c:\program files\RealArcade
    2009-03-21 14:06 . 2009-03-21 14:06 989696
    w c:\windows\system32\dllcache\kernel32.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-19 15:44 . 2008-03-28 14:18
    d
    w c:\program files\MagicISO
    2009-04-19 15:43 . 2006-07-16 02:57
    d
    w c:\program files\Google
    2009-04-19 15:41 . 2006-07-16 02:43
    d--h--w c:\program files\InstallShield Installation Information
    2009-04-19 15:00 . 2009-04-19 10:59 1080 ----a-w C:\aaw7boot.log
    2009-04-19 10:59 . 2009-03-06 15:53 90112 ----a-w c:\windows\DUMPa316.tmp
    2009-04-19 09:36 . 2009-04-19 09:37 1810944 ----a-w c:\windows\Internet Logs\xDB2.tmp
    2009-04-18 15:00 . 2008-05-29 06:13
    d
    w c:\documents and settings\All Users\Application Data\avg8
    2009-04-18 00:11 . 2007-06-01 00:03
    d
    w c:\documents and settings\HP_Administrator\Application Data\uTorrent
    2009-04-16 18:04 . 2006-07-16 02:06
    d
    w c:\program files\Java
    2009-04-16 17:54 . 2006-10-31 17:02
    d
    w c:\program files\LimeWire
    2009-04-13 15:03 . 2006-10-31 19:21
    d
    w c:\documents and settings\HP_Administrator\Application Data\Apple Computer
    2009-04-10 23:25 . 2007-08-28 20:21
    d
    w c:\program files\Common Files\Apple
    2009-04-06 15:27 . 2009-03-19 21:30
    d
    w c:\program files\Zylom Games
    2009-04-06 14:26 . 2009-03-19 21:31
    d
    w c:\documents and settings\HP_Administrator\Application Data\Zylom
    2009-04-04 03:05 . 2008-03-18 15:45
    d
    w c:\program files\DivX
    2009-03-27 15:02 . 2007-07-09 13:57 268 ---ha-w C:\sqmdata03.sqm
    2009-03-27 15:02 . 2007-07-09 13:57 244 ---ha-w C:\sqmnoopt03.sqm
    2009-03-27 10:02 . 2007-01-16 00:20 4212 ---ha-w c:\windows\system32\zllictbl.dat
    2009-03-27 09:25 . 2007-07-06 12:42 268 ---ha-w C:\sqmdata02.sqm
    2009-03-27 09:25 . 2007-07-06 12:42 244 ---ha-w C:\sqmnoopt02.sqm
    2009-03-26 14:38 . 2007-07-04 16:46 268 ---ha-w C:\sqmdata01.sqm
    2009-03-26 14:38 . 2007-07-04 16:46 244 ---ha-w C:\sqmnoopt01.sqm
    2009-03-26 10:04 . 2007-07-04 07:34 268 ---ha-w C:\sqmdata00.sqm
    2009-03-26 10:04 . 2007-07-04 07:34 244 ---ha-w C:\sqmnoopt00.sqm
    2009-03-25 23:20 . 2008-01-02 19:30 268 ---ha-w C:\sqmdata19.sqm
    2009-03-25 23:20 . 2008-01-02 19:30 244 ---ha-w C:\sqmnoopt19.sqm
    2009-03-25 08:45 . 2007-12-05 17:39 268 ---ha-w C:\sqmdata18.sqm
    2009-03-25 08:45 . 2007-12-05 17:39 244 ---ha-w C:\sqmnoopt18.sqm
    2009-03-23 17:35 . 2007-09-15 17:41 268 ---ha-w C:\sqmdata17.sqm
    2009-03-23 17:35 . 2007-09-15 17:41 244 ---ha-w C:\sqmnoopt17.sqm
    2009-03-23 08:20 . 2007-09-15 09:54 268 ---ha-w C:\sqmdata16.sqm
    2009-03-23 08:20 . 2007-09-15 09:54 244 ---ha-w C:\sqmnoopt16.sqm
    2009-03-21 17:39 . 2006-10-22 21:11 55472 ----a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-03-19 21:30 . 2009-03-19 21:30
    d
    w c:\documents and settings\All Users\Application Data\Zylom
    2009-03-19 15:32 . 2008-01-29 11:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-19 13:26 . 2009-03-19 13:26
    d
    w c:\program files\MSBuild
    2009-03-19 13:26 . 2009-03-19 13:26
    d
    w c:\program files\Reference Assemblies
    2009-03-18 22:41 . 2009-03-18 22:40
    d
    w c:\program files\Microsoft IntelliPoint
    2009-03-18 15:56 . 2009-03-18 15:55
    d
    w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    2009-03-18 15:52 . 2008-12-23 12:19
    d
    w c:\program files\QuickTime
    2009-03-09 14:59 . 2009-03-09 14:59
    d
    w c:\program files\Atari
    2009-03-08 21:50 . 2009-03-08 21:50 3532 ----a-w C:\drmHeader.bin
    2009-03-08 17:06 . 2009-03-08 17:08 869376 ----a-w c:\windows\Internet Logs\xDB1.tmp
    2009-03-08 15:08 . 2008-12-16 22:51
    d
    w c:\documents and settings\HP_Administrator\Application Data\Move Networks
    2009-03-08 15:01 . 2009-03-08 15:01
    d
    w c:\program files\Microsoft Silverlight
    2009-03-08 13:32 . 2009-03-08 13:32
    d
    w c:\documents and settings\HP_Administrator\Application Data\Uniblue
    2009-03-08 12:41 . 2009-03-08 12:41
    d
    w c:\program files\uTorrent
    2009-03-08 11:09 . 2007-08-27 20:34 268 ---ha-w C:\sqmdata15.sqm
    2009-03-08 11:09 . 2007-08-27 20:34 244 ---ha-w C:\sqmnoopt15.sqm
    2009-03-08 01:32 . 2007-08-27 17:57 268 ---ha-w C:\sqmdata14.sqm
    2009-03-08 01:32 . 2007-08-27 17:57 244 ---ha-w C:\sqmnoopt14.sqm
    2009-03-07 11:30 . 2007-08-27 17:28 268 ---ha-w C:\sqmdata13.sqm
    2009-03-07 11:30 . 2007-08-27 17:28 244 ---ha-w C:\sqmnoopt13.sqm
    2009-03-07 11:17 . 2007-08-27 16:38 268 ---ha-w C:\sqmdata12.sqm
    2009-03-07 11:17 . 2007-08-27 16:38 244 ---ha-w C:\sqmnoopt12.sqm
    2009-03-07 11:08 . 2009-03-07 11:08
    d
    w c:\program files\Alwil Software
    2009-03-06 22:02 . 2007-07-25 14:23 268 ---ha-w C:\sqmdata11.sqm
    2009-03-06 22:02 . 2007-07-25 14:23 244 ---ha-w C:\sqmnoopt11.sqm
    2009-03-06 21:33 . 2007-07-22 19:15 268 ---ha-w C:\sqmdata10.sqm
    2009-03-06 21:33 . 2007-07-22 19:15 244 ---ha-w C:\sqmnoopt10.sqm
    2009-03-06 20:45 . 2007-07-18 15:15 268 ---ha-w C:\sqmdata09.sqm
    2009-03-06 20:45 . 2007-07-18 15:15 244 ---ha-w C:\sqmnoopt09.sqm
    2009-03-06 15:46 . 2009-03-06 15:46 85439 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_06_15_43_27_small.dmp.zip
    2009-03-06 15:43 . 2009-03-06 15:43 85535 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_06_15_28_39_small.dmp.zip
    2009-03-06 15:28 . 2009-03-06 15:28 84219 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_06_15_26_05_small.dmp.zip
    2009-03-06 15:25 . 2009-03-06 15:25 83978 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_06_15_21_30_small.dmp.zip
    2009-03-06 15:21 . 2009-03-06 15:21 84223 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_03_06_15_17_45_small.dmp.zip
    2009-03-06 15:16 . 2007-07-17 20:41 268 ---ha-w C:\sqmdata08.sqm
    2009-03-06 15:16 . 2007-07-17 20:41 244 ---ha-w C:\sqmnoopt08.sqm
    2009-03-06 14:22 . 2004-08-09 21:00 284160 ----a-w c:\windows\system32\pdh.dll
    2009-03-06 13:59 . 2009-03-06 13:59
    d
    w c:\documents and settings\All Users\Application Data\SupportSoft
    2009-03-06 13:58 . 2009-03-06 13:57
    d
    w c:\program files\O2
    2009-03-06 13:44 . 2009-03-06 13:44
    d
    w c:\program files\Common Files\SupportSoft
    2009-03-03 00:18 . 2004-08-09 21:00 826368 ----a-w c:\windows\system32\wininet.dll
    2009-03-03 00:18 . 2004-08-09 21:00 826368 ----a-w c:\windows\system32\dllcache\wininet.dll
    2009-02-28 04:54 . 2004-08-09 21:00 636072 ----a-w c:\windows\system32\dllcache\iexplore.exe
    2009-02-24 19:34 . 2009-02-24 19:34 90112 ----a-w c:\windows\system32\dpl100.dll
    2009-02-24 19:34 . 2009-02-24 19:34 823296 ----a-w c:\windows\system32\divx_xx0c.dll
    2009-02-24 19:34 . 2009-02-24 19:34 823296 ----a-w c:\windows\system32\divx_xx07.dll
    2009-02-24 19:34 . 2009-02-24 19:34 815104 ----a-w c:\windows\system32\divx_xx0a.dll
    2009-02-24 19:34 . 2009-02-24 19:34 802816 ----a-w c:\windows\system32\divx_xx11.dll
    2009-02-24 19:34 . 2009-02-24 19:34 684032 ----a-w c:\windows\system32\DivX.dll
    2009-02-21 09:27 . 2007-07-16 20:24 268 ---ha-w C:\sqmdata07.sqm
    2009-02-21 09:27 . 2007-07-16 20:24 244 ---ha-w C:\sqmnoopt07.sqm
    2009-02-20 10:20 . 2007-05-09 17:02 13824 ----a-w c:\windows\system32\dllcache\ieudinit.exe
    2009-02-20 10:20 . 2004-08-09 21:00 70656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
    2009-02-20 05:14 . 2004-08-09 21:00 161792 ----a-w c:\windows\system32\dllcache\ieakui.dll
    2009-02-17 16:39 . 2007-07-16 19:01 268 ---ha-w C:\sqmdata06.sqm
    2009-02-17 16:39 . 2007-07-16 19:01 244 ---ha-w C:\sqmnoopt06.sqm
    2009-02-16 00:10 . 2009-03-08 12:43 1221512 ----a-w c:\windows\system32\zpeng25.dll
    2009-02-15 01:01 . 2007-07-14 09:43 268 ---ha-w C:\sqmdata05.sqm
    2009-02-15 01:01 . 2007-07-14 09:43 244 ---ha-w C:\sqmnoopt05.sqm
    2009-02-15 00:19 . 2007-07-13 18:25 268 ---ha-w C:\sqmdata04.sqm
    2009-02-15 00:19 . 2007-07-13 18:25 244 ---ha-w C:\sqmnoopt04.sqm
    2009-02-09 12:10 . 2004-08-09 21:00 729088 ----a-w c:\windows\system32\lsasrv.dll
    2009-02-09 12:10 . 2004-08-10 04:00 714752 ----a-w c:\windows\system32\ntdll.dll
    2009-02-09 12:10 . 2004-08-09 21:00 617472 ----a-w c:\windows\system32\advapi32.dll
    2009-02-09 12:10 . 2004-08-09 21:00 401408 ----a-w c:\windows\system32\rpcss.dll
    2009-02-09 11:13 . 2008-11-26 01:10 1846784 ----a-w c:\windows\system32\dllcache\win32k.sys
    2009-02-09 11:13 . 2004-08-09 21:00 1846784 ----a-w c:\windows\system32\win32k.sys
    2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-02-24 19:2009-02-24 19:34 34:32 . c:\program files\mozilla firefox\plugins\ssldivx.dll
    2008-12-17 14:44 . 2008-12-17 14:44 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121720081218\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2008-10-16 18:22 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-02-13 7557120]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-18 1932568]
    "ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-08 16010240]
    "AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]
    "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-04-18 11:54 10520 ----a-w c:\windows\system32\avgrsstx.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
    backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless USB Utility.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless USB Utility.lnk
    backup=c:\windows\pss\Belkin Wireless USB Utility.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
    backup=c:\windows\pss\LimeWire On Startup.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Belkin\\USB F5D7050\\Wireless Utility\\Belkinwcui.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
    "c:\\Program Files\\Alwil Software\\Avast4\\ashDisp.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "30672:TCP"= 30672:TCP:Bit Torrent

    S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-18 12552]
    S1 aswSP;avast! Self Protection; [x]
    S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-18 325640]
    S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-18 108552]
    S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-16 464264]
    S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
    S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-18 298264]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - ALERTER

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
    \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17a8c1b6-bb55-11dd-9a8b-0016eca352bb}]
    \Shell\AutoRun\command - J:\setup.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20f24d05-6463-11dc-9828-0016eca352bb}]
    \Shell\AutoRun\command - J:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{679da352-54e1-11dc-981c-0016eca352bb}]
    \Shell\AutoRun\command - K:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{679da355-54e1-11dc-981c-0016eca352bb}]
    \Shell\AutoRun\command - K:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9538b04-55a3-11dc-981d-0016eca352bb}]
    \Shell\AutoRun\command - J:\AutoRun.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 12:34]

    2009-04-19 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
    - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

    2009-03-18 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
    - c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 12:56]
    .
    Accept that some days you're the pigeon and some days you're the statue.
  • carrie483
    carrie483 Posts: 1,868 Forumite
    - - - - ORPHANS REMOVED - - - -

    Notify-yayyWqQj - yayyWqQj.dll


    .
    Supplementary Scan
    .
    uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
    mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=63&bd=PAVILION&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
    IE: &Search
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
    TCP: {2096E753-C77D-459F-B010-F8353A27F8EB} = 194.168.4.100,194.168.8.100
    FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\fem57wf5.default\
    FF - prefs.js: browser.startup.homepage - https://www.yahoo.co.uk
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1856535&SearchSource=2&q=
    FF - component: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\fem57wf5.default\extensions\{2dd8ae44-bd83-45b1-a3e5-451f60672ec1}\components\FFAlert.dll
    FF - component: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\fem57wf5.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
    FF - component: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\fem57wf5.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
    FF - plugin: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\fem57wf5.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npcsau7.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-19 22:12
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    LOCKED REGISTRY KEYS

    [HKEY_USERS\S-1-5-21-2969302126-4026353310-1886354327-1007\Software\YourCompanyName\YourProductName\Version*]
    "VersionData"=hex:9a,44,c7,8c,ee,aa,f7,03,3b,7d,6b,e2,e9,7a,c7,dc,a3,34,2b,27,
    dd,ad,45,bd,5e,ee,ac,6a,f3,2a,49,66,5a,64,28,63,c6,f8,2a,1d,29,ee,0d,7f,1b,\
    .
    Completion time: 2009-04-19 22:15
    ComboFix-quarantined-files.txt 2009-04-19 21:15

    Pre-Run: 19,528,556,544 bytes free
    Post-Run: 25,976,455,168 bytes free

    352 --- E O F --- 2009-04-15 09:25
    Accept that some days you're the pigeon and some days you're the statue.
  • carrie483
    carrie483 Posts: 1,868 Forumite
    Sorry, had to post in 2 post as was too long
    Accept that some days you're the pigeon and some days you're the statue.
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Carrie ~ you MUST uninstall AVG or AVAST

    Running both is a very bad idea. Please choose one and uninstall the other (Using the removal tool if you remove AVG which I really suggest you do)

    Or you could remove both and replace with AVIRA (Which I personally use)
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 352.5K Banking & Borrowing
  • 253.7K Reduce Debt & Boost Income
  • 454.5K Spending & Discounts
  • 245.5K Work, Benefits & Business
  • 601.5K Mortgages, Homes & Bills
  • 177.6K Life & Family
  • 259.5K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture