Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: malware removal guide  (Read 10053 times)

0 Members and 1 Guest are viewing this topic.

notevenclose

    Topic Starter


    Rookie

    malware removal guide
    « on: May 11, 2009, 12:11:50 PM »
     I'm following the  "read this before requesting malware removal help" guide and have a question : I have Adaware installed on my laptop will it conflict with any of the recommended downloads? should i uninstall it ?

    evilfantasy

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Calm like a bomb
    • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: malware removal guide
    « Reply #1 on: May 11, 2009, 12:36:37 PM »
    No it won't.

    notevenclose

      Topic Starter


      Rookie

      Re: malware removal guide
      « Reply #2 on: May 11, 2009, 04:15:05 PM »
      Because i cant open my browser I'm downloading programs to a jump drive. and installing them to my infected laptop.So far i have CCcleaner installed. However, I could not update it ( my wireless connection is strong and I was able to update AVG but can't open any web pages)

      Is there any way around this? Below is my origanal post of the problem:


      After being sick for three days I started my daughters laptop and found all kinds of spyware malware and trojans... AVG  is scheduled to run everyday but I think when it started acting hinky she just shut it down)..Any road, I ran AVG , Adaware, and Spybot SD, and they cleared it up, However, my  browser-Explorer-was still not right. I tried to do a system restore but it would not let me not even in safe mode…so I ran Spybot  again and it found registry changes…Data source object exploit  and healed them but it was still not right when I ran SD  again it found the DOS exploit  but said- registry change, nothing done. With each shut down it got worse. Now I can't connect to the internet even in safe mode  and I can only access regedit.exe if  I'm in safe mode.. I found them but I don't know what to do to them or what the  !=w=3 means since it's not at the end of the registries I brought up . Can anyone help me.

      The laptop is a  Dell  Inspiron 8100 running  XP home edition, version 2000 service pack 2 ( I got it used about a month ago for my daughter in excellent condition an running great) AVG, Adaware and Spybot SD all free versions are installed
       These are the registries that have been changed:

      HKey_users \ s-1-5-18\software\microsoft\windows\currentversion\internetsettings\zones\0\1004!= w =3

      HKey _ users\ s-1-5-21-1547161642-199396763-854245398\software\microsoft\windows\currentversion\internetsettings\zones\0\1004!= w =3

      HKey _ users\ s-1-5-20\software\microsoft\windows\currentversion\internetsettings\zones\0\1004!= w =3

      HKey _ users\ s-1-5-19\software\microsoft\windows\currentversion\internetsettings\zones\0\1004!= w =3

      HKey _ users\.Default\software\microsoft\windows\currentversion\internetsettings\zones\0\1004!= w =3

      Thank You

      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: malware removal guide
      « Reply #3 on: May 11, 2009, 04:22:03 PM »
      As long as you can get SUPERAntispyware and Malwarebytes installed and run them then that should be good enough. We will update them later when you have internet access.

      notevenclose

        Topic Starter


        Rookie

        Re: malware removal guide
        « Reply #4 on: May 12, 2009, 01:53:57 PM »
         Hi
        I finally got all the logs onto a jump drive (I take care of my 80 year old mother.... little free time) 

         Frist let me tell you the laptop does not have Java installed...also when i start up I get a: "your computer has recoverd from a serious error
        msg."     this happend before I installed the spyware programs

        the errors are below

         C\docume~1\default\locals~1\temp\wer2f4e.dir00\Mini051209-01dmp

        C\docume~1\default\locals~1\temp\wer2f4e.dir00\sysdata.xml


        here are the spyware logs,

        Thank you
        SUPERAntiSpyware Scan Log
        http://www.superantispyware.com

        Generated 05/11/2009 at 10:48 PM

        Application Version : 4.26.1002

        Core Rules Database Version : 3868
        Trace Rules Database Version: 1816

        Scan type       : Complete Scan
        Total Scan Time : 00:58:47

        Memory items scanned      : 389
        Memory threats detected   : 0
        Registry items scanned    : 5066
        Registry threats detected : 24
        File items scanned        : 51297
        File threats detected     : 18

        Adware.Vundo Variant
           HKLM\Software\Classes\CLSID\{ABD45510-9B22-41cd-9ACD-8182A2DA7C63}
           HKCR\CLSID\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}
           HKCR\CLSID\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}
           HKCR\CLSID\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}\InProcServer32
           HKCR\CLSID\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}\InProcServer32#ThreadingModel
           C:\WINDOWS\SYSTEM32\IEHELPER.DLL
           HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}
           HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ABD45510-9B22-41CD-9ACD-8182A2DA7C63}

        Adware.E404 Helper/Hij
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS
           HKCR\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR
           HKCR\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}
           HKCR\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid
           HKCR\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32
           HKCR\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib
           HKCR\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib#Version

        Trojan.Unclassified/C00-WL
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810#Asynchronous
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810#DllName
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810#Impersonate
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810#Startup
           HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C007D810#Logon

        Adware.Tracking Cookie
           C:\Documents and Settings\Quay\Cookies\[email protected][1].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][2].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][2].txt
           C:\Documents and Settings\Quay\Cookies\quay@bravenet[1].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][1].txt
           C:\Documents and Settings\Quay\Cookies\quay@media6degrees[2].txt
           C:\Documents and Settings\Quay\Cookies\quay@specificclick[1].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][1].txt
           C:\Documents and Settings\Quay\Cookies\quay@atwola[1].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][1].txt
           C:\Documents and Settings\Quay\Cookies\quay@clicksense[1].txt
           C:\Documents and Settings\Quay\Cookies\quay@interclick[2].txt
           C:\Documents and Settings\Quay\Cookies\quay@collective-media[1].txt
           C:\Documents and Settings\Quay\Cookies\quay@invitemedia[1].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][2].txt
           C:\Documents and Settings\Quay\Cookies\[email protected][1].txt
           C:\Documents and Settings\Quay\Cookies\quay@specificmedia[1].txt



        Malwarebytes' Anti-Malware 1.36
        Database version: 1945
        Windows 5.1.2600 Service Pack 2

        5/11/2009 11:35:21 PM
        mbam-log-2009-05-11 (23-35-21).txt

        Scan type: Quick Scan
        Objects scanned: 91393
        Time elapsed: 7 minute(s), 28 second(s)

        Memory Processes Infected: 0
        Memory Modules Infected: 0
        Registry Keys Infected: 5
        Registry Values Infected: 1
        Registry Data Items Infected: 6
        Folders Infected: 0
        Files Infected: 6

        Memory Processes Infected:
        (No malicious items detected)

        Memory Modules Infected:
        (No malicious items detected)

        Registry Keys Infected:
        HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

        Registry Values Infected:
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diagnostic manager (Trojan.Downloader) -> Quarantined and deleted successfully.

        Registry Data Items Infected:
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

        Folders Infected:
        (No malicious items detected)

        Files Infected:
        C:\WINDOWS\t55ft2692f44.dat (Trojan.KoobFace) -> Quarantined and deleted successfully.
        C:\WINDOWS\st_1241740591.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\st_1241734629.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\SYSTEM32\p2hhr.bat (Malware.Trace) -> Quarantined and deleted successfully.
        C:\Documents and Settings\default\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Guest\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully.



        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 12:40:53 AM, on 5/12/2009
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\Nhksrv.exe
        C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\PROGRA~1\AVG\AVG8\avgemc.exe
        C:\PROGRA~1\AVG\AVG8\avgrsx.exe
        C:\PROGRA~1\AVG\AVG8\avgnsx.exe
        C:\Program Files\AVG\AVG8\avgcsrvx.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\WINDOWS\DELLMMKB.EXE
        C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
        C:\Program Files\Netropa\OSD.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\PROGRA~1\AVG\AVG8\avgtray.exe
        C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Trend Micro\HijackThis\sniper.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
        R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cf.icq.com/cf/2000/lost_password.html
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
        O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
        O2 - BHO: C:\WINDOWS\system32\afnoinkdsfe.dll - {C2BA40A1-74F3-42BD-F434-12345A2C8953} - C:\WINDOWS\system32\afnoinkdsfe.dll (file missing)
        O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
        O2 - BHO: 796525 helper - {E7F15AC4-E0A9-43F0-921B-70DFEA621220} - C:\WINDOWS\system32\796525\796525.dll (file missing)
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
        O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
        O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
        O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
        O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
        O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
        O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe"  /autorun
        O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
        O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
        O4 - HKUS\S-1-5-19\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-20\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User 'NETWORK SERVICE')
        O4 - HKUS\S-1-5-18\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User 'Default user')
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL
        O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL
        O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com/ (file missing) (HKCU)
        O16 - DPF: Win32 Classes -
        O16 - DPF: {17163BB4-107E-11D4-9B76-006097DF2317} (EABootStrap Class) - http://aol.ea.com/downloads/games/common/boot_strap/iegils.cab
        O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
        O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164998083052
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164998017898
        O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
        O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
        O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
        O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
        O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
        O22 - SharedTaskScheduler: jso8joigm409gopgmrlgd - {B2BA40A2-74F0-42BD-F434-12345A2C8953} - C:\WINDOWS\system32\yhs783ijfo3fe.dll (file missing)
        O22 - SharedTaskScheduler: sdfsefsfdvdubgiungfuyd - {C2BA40A1-74F3-42BD-F434-12345A2C8953} - C:\WINDOWS\system32\afnoinkdsfe.dll (file missing)
        O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
        O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
        O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 9067 bytes


        [attachment deleted by admin]
        « Last Edit: May 12, 2009, 02:12:38 PM by notevenclose »

        evilfantasy

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Calm like a bomb
        • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: malware removal guide
        « Reply #5 on: May 12, 2009, 07:08:07 PM »
        Can you connect to the internet now, if not what happens when you try?

        Have you tried resetting the router?

        notevenclose

          Topic Starter


          Rookie

          Re: malware removal guide
          « Reply #6 on: May 13, 2009, 09:45:31 AM »
           I booted up in safe mode and opened Netgear wizard it said my card was not connected (This is new  Before  it said I had a great connection) However  the lights on my card were blinking as they should be.

           I removed the card and reinserted it  ...same thing card not connected but lights blinking...
          I went to divice mgr. checked the card and ports it said all were working properly .... 

          I connected an ethernet cable  and was able to connect to internet  :)although my home page was changed to Microsoft and when  did a shearch all it displayed were MS sites even when I put an address in the address bar

          I  restarted in normal mode and got the error msg. "your pc has recovered from a serious error "

          I reported it to MS and it started to take me to  the error page but I got "This page could not be displayed"

          restarted in safe mode was able to connect.... changed my home page to yahoo 
          and was able to search
           that's where I left it.... I thought  about trying to do a system restore but  decided to wait for an expert
          Thank u

          evilfantasy

          • Malware Removal Specialist
          • Moderator


          • Genius
          • Calm like a bomb
          • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: malware removal guide
          « Reply #7 on: May 13, 2009, 10:14:50 AM »
          Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

          Link #1
          Link #2

          **Note:  It is important that it is saved directly to your Desktop

          Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

          Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
           
          Double click combofix.exe & follow the prompts.
          Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
          When finished ComboFix will produce a log for you.
          Post the ComboFix log in your next reply.

          Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

          Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

          If you have problems with ComboFix usage, see How to use ComboFix

          notevenclose

            Topic Starter


            Rookie

            Re: malware removal guide
            « Reply #8 on: May 13, 2009, 12:05:34 PM »
            Can I do this in safe mode? or should I do the whole zip drive thing. ???

            Thank you for being patient

            evilfantasy

            • Malware Removal Specialist
            • Moderator


            • Genius
            • Calm like a bomb
            • Thanked: 493
            • Experience: Experienced
            • OS: Windows 11
            Re: malware removal guide
            « Reply #9 on: May 13, 2009, 12:10:39 PM »
            Do it in Normal Mode if possible. If not then it will run in Safe Mode also.

            notevenclose

              Topic Starter


              Rookie

              Re: malware removal guide
              « Reply #10 on: May 15, 2009, 10:24:29 AM »
              Hi I'm posting this from the infected laptop using wireless :) but it took awhile first when I when 2 turn off my firewall to install Combo fix I discovered it was off . could a virus do that? I don't remember turning it off ...but some days I'm so busy I don't no if I’m coming or going. Any road ,I went through the whole removal guide again ...And low and behold.... spy ware, malware, Trojans..( I'll attach logs to this post) when I went to install Combo from the zip drive it told me to uninstall and to uninstall and try again I downloaded in safe mode and saved to desktop. ...I restarted in normal and the icon was not on my desktop so back to safe and ran it there ..when it said to restart I  got nervous but it restarted in normal and continued its fix   below is the log

              OK I can’t find the Super anti spyware log.. I know I ran It..It must be in safe mode … I must have been tired cuz I don’t remember running it in safe mode.. There’s an Administrator user in safe mode that doesn’t load in normal  ( I opened that instead of mine so I wouldn’t have to enter my password (  I have ADD and do stupid things like that sometimes …impatient and  impulsive  )That’s where   the Combo fix icon is ….If you need to see it I’ll get it 4 you right now I have to get back to mom…

              Thank you so much


              ComboFix 09-05-14.03 - default 05/15/2009  1:37.1 - FAT32x86
              Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.511.278 [GMT -4:00]
              Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
              AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
              .

              (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\documents and settings\Administrator\Local Settings\Temp\Perflib_Perfdata__755.dat
              c:\windows\start.exe
              c:\windows\system32\drivers\ovfsthxlklrxuje.sys
              c:\windows\system32\ovfsthxboxttdrg.dll
              c:\windows\system32\ovfsthxdfjwsnsr.dat
              c:\windows\system32\ovfsthxnkirtbwu.dat
              c:\windows\system32\ovfsthxsviletqf.dll
              c:\windows\system32\ovfsthxyxuwkrwr.dll
              c:\windows\system32\uniq.tll
              c:\windows\system32\windows.scr
              c:\windows\Web\default.htt
              C:\xcrashdump.dat

              .
              (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              -------\Service_ovfsthxibwafpby


              (((((((((((((((((((((((((   Files Created from 2009-04-15 to 2009-05-15  )))))))))))))))))))))))))))))))
              .

              2009-05-15 05:34 . 2009-05-15 05:34   --------   d-sh--w   C:\FOUND.001
              2009-05-14 21:10 . 2009-05-14 21:10   --------   d-----w   c:\documents and settings\Administrator\Application Data\Malwarebytes
              2009-05-14 21:08 . 2009-05-14 21:08   --------   d-----w   c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
              2009-05-14 02:18 . 2009-05-14 02:18   74352   ----a-w   c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
              2009-05-12 03:59 . 2009-05-12 03:59   --------   d-----w   c:\program files\Trend Micro
              2009-05-12 03:19 . 2009-05-12 03:19   --------   d-----w   c:\documents and settings\default\Application Data\Malwarebytes
              2009-05-12 03:19 . 2009-05-12 03:19   --------   d-----w   c:\documents and settings\default\Application Data\Malwarebytes
              2009-05-12 03:19 . 2009-04-06 19:32   15504   ----a-w   c:\windows\system32\drivers\mbam.sys
              2009-05-12 03:19 . 2009-04-06 19:32   38496   ----a-w   c:\windows\system32\drivers\mbamswissarmy.sys
              2009-05-12 03:19 . 2009-05-12 03:19   --------   d-----w   c:\documents and settings\All Users\Application Data\Malwarebytes
              2009-05-12 03:19 . 2009-05-12 03:19   --------   d-----w   c:\program files\Malwarebytes' Anti-Malware
              2009-05-12 01:22 . 2009-05-12 01:22   --------   d-----w   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
              2009-05-12 01:22 . 2009-05-12 01:22   --------   d-----w   c:\program files\SUPERAntiSpyware
              2009-05-12 01:22 . 2009-05-12 01:22   --------   d-----w   c:\documents and settings\default\Application Data\SUPERAntiSpyware.com
              2009-05-12 01:22 . 2009-05-12 01:22   --------   d-----w   c:\documents and settings\default\Application Data\SUPERAntiSpyware.com
              2009-05-11 18:24 . 2009-05-11 18:24   --------   d-----w   c:\program files\CCleaner
              2009-05-09 20:46 . 2009-05-09 20:46   --------   d-----w   c:\documents and settings\default\Apps
              2009-05-09 19:35 . 2009-05-09 19:35   --------   d-----w   c:\documents and settings\All Users\Application Data\WEBREG
              2009-05-09 18:51 . 2009-05-09 18:51   --------   d-----w   c:\documents and settings\default\Application Data\HP
              2009-05-09 18:51 . 2009-05-09 18:51   --------   d-----w   c:\documents and settings\default\Application Data\HP
              2009-05-09 18:49 . 2008-01-24 21:29   16496   ----a-r   c:\windows\system32\drivers\HPZipr12.sys
              2009-05-09 18:49 . 2008-01-24 21:29   49920   ----a-r   c:\windows\system32\drivers\HPZid412.sys
              2009-05-09 18:49 . 2009-05-09 18:49   --------   d-----w   c:\documents and settings\All Users\Application Data\Hewlett-Packard
              2009-05-09 18:49 . 2008-01-24 21:31   271704   ----a-r   c:\windows\system32\hpzids01.dll
              2009-05-09 18:49 . 2007-10-20 22:25   118272   ----a-w   c:\windows\system32\hpz3l5mu.dll
              2009-05-09 18:48 . 2008-01-24 21:30   309760   ----a-r   c:\windows\system32\difxapi.dll
              2009-05-09 18:48 . 2008-01-24 21:30   372736   ----a-r   c:\windows\system32\hppldcoi.dll
              2009-05-09 18:48 . 2008-01-24 21:30   21568   ----a-r   c:\windows\system32\drivers\HPZius12.sys
              2009-05-09 18:41 . 2009-05-09 18:41   --------   d-----w   c:\documents and settings\All Users\Application Data\HP
              2009-05-09 18:39 . 2009-05-09 18:39   --------   d-----w   c:\windows\system32\DRVSTORE
              2009-05-09 18:38 . 2009-05-09 18:38   --------   d-----w   c:\program files\HP
              2009-05-09 18:38 . 2004-08-04 05:01   25856   ----a-w   c:\windows\system32\dllcache\usbprint.sys
              2009-05-09 18:38 . 2004-08-04 05:01   25856   ----a-w   c:\windows\system32\drivers\usbprint.sys
              2009-05-09 18:38 . 2004-08-04 05:08   31616   ----a-w   c:\windows\system32\dllcache\usbccgp.sys
              2009-05-09 18:38 . 2004-08-04 05:08   31616   ----a-w   c:\windows\system32\drivers\usbccgp.sys
              2009-05-09 01:29 . 2009-05-09 01:29   --------   d-----w   c:\program files\Common Files\AOLSHARE
              2009-05-07 15:07 . 2009-03-06 14:44   283648   ------w   c:\windows\system32\dllcache\pdh.dll
              2009-05-07 15:07 . 2005-07-26 04:39   60416   ------w   c:\windows\system32\dllcache\colbact.dll
              2009-05-07 15:07 . 2009-02-09 10:20   399360   ------w   c:\windows\system32\dllcache\rpcss.dll
              2009-05-07 15:07 . 2009-02-06 17:14   110592   ------w   c:\windows\system32\dllcache\services.exe
              2009-05-07 15:07 . 2009-02-09 10:20   473088   ------w   c:\windows\system32\dllcache\fastprox.dll
              2009-05-07 15:07 . 2009-02-06 16:39   227840   ------w   c:\windows\system32\dllcache\wmiprvse.exe
              2009-05-07 15:07 . 2009-02-09 10:20   453120   ------w   c:\windows\system32\dllcache\wmiprvsd.dll
              2009-05-07 15:07 . 2009-02-09 10:20   616960   ------w   c:\windows\system32\dllcache\advapi32.dll
              2009-05-07 15:07 . 2009-02-09 10:20   714752   ------w   c:\windows\system32\dllcache\ntdll.dll
              2009-05-07 15:05 . 2008-04-21 10:02   215552   ------w   c:\windows\system32\dllcache\wordpad.exe
              2009-05-07 00:44 . 2009-05-07 00:44   --------   d-----w   c:\program files\RegistryRepair
              2009-05-04 14:28 . 2009-05-04 14:28   --------   d-----w   c:\program files\TeaTimer (Spybot - Search & Destroy)
              2009-05-04 14:28 . 2009-05-04 14:28   --------   d-----w   c:\program files\Misc. Support Library (Spybot - Search & Destroy)
              2009-05-04 14:28 . 2009-05-04 14:28   --------   d-----w   c:\program files\SDHelper (Spybot - Search & Destroy)
              2009-05-04 14:28 . 2009-05-04 14:28   --------   d-----w   c:\program files\File Scanner Library (Spybot - Search & Destroy)
              2009-05-04 14:21 . 2009-05-04 14:21   --------   d-----w   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
              2009-05-04 14:21 . 2009-05-04 14:21   --------   d-----w   c:\program files\Spybot - Search & Destroy
              2009-04-16 10:45 . 2001-10-11 15:26   65536   ----a-w   c:\windows\system32\YCRWin32.dll
              2009-04-16 10:45 . 2002-01-05 11:37   344064   ----a-w   c:\windows\system32\msvcr70.dll
              2009-04-16 10:45 . 2002-01-05 10:18   84992   ----a-w   c:\windows\system32\ATL70.DLL

              .
              ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2009-05-15 04:29 . 2006-12-01 14:49   90112   ----a-w   c:\windows\DUMP88cc.tmp
              2009-04-22 04:12 . 2006-12-02 17:58   17015   ----a-w   c:\windows\system32\nvModes.dat
              2009-04-14 13:16 . 2006-12-03 15:33   74352   ----a-w   c:\documents and settings\default\Application Data\GDIPFONTCACHEV1.DAT
              2009-04-14 13:16 . 2006-12-03 15:33   74352   ----a-w   c:\documents and settings\default\Application Data\GDIPFONTCACHEV1.DAT
              2009-03-23 21:48 . 2009-03-23 21:48   --------   d-----w   c:\program files\Common Files\Wise Installation Wizard
              2009-03-06 14:44 . 2006-12-02 19:01   283648   ----a-w   c:\windows\system32\pdh.dll
              2009-02-20 08:14 . 2006-06-23 15:33   668160   ----a-w   c:\windows\system32\wininet.dll
              2009-02-20 08:14 . 2004-08-04 06:56   81920   ------w   c:\windows\system32\ieencode.dll
              2000-10-13 20:56 . 2000-10-13 20:56   271   --sh--w   c:\program files\desktop.ini
              2000-10-13 20:56 . 2000-10-13 20:56   23357   ---h--w   c:\program files\folder.htt
              .

              (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* empty entries & legit default entries are not shown
              REGEDIT4

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2000-07-19 176183]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2001-10-08 110592]
              "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2001-10-08 401408]
              "DellTouch"="c:\windows\DELLMMKB.EXE" [2001-09-23 163840]
              "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-06-24 4800512]
              "AS00_Gear511"="c:\program files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412]
              "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
              "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
              "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-03 1601304]
              "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-05-07 68592]
              "nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2003-06-24 323584]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
              "MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2000-07-19 176183]

              c:\documents and settings\All Users\Start Menu\Programs\Startup\
              Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
              Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

              [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
              "NoSetActiveDesktop"= 1 (0x1)
              "NoActiveDesktopChanges"= 1 (0x1)

              [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
              "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
              2008-12-22 16:05   356352   ----a-w   c:\program files\SUPERAntiSpyware\SASWINLO.dll

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
              2009-02-03 01:32   10520   ----a-w   c:\windows\SYSTEM32\avgrsstx.dll

              HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
              "wave1"= serwvdrv.dll

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
              "MSMSGS"="c:\program files\MESSENGER\MSMSGS.EXE" /background
              "Mirabilis ICQ"=c:\program files\ICQ\NDetect.exe
              "Weather"=c:\program files\AWS\WEATHERBUG\WEATHER.EXE 1
              "Microsoft Works Update Detection"=c:\program files\Microsoft Works\WkDetect.exe
              "Yahoo! Pager"=c:\program files\Yahoo!\Messenger\ypager.exe -quiet

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
              "MMTray"=c:\program files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
              "LapLink Scheduler"="c:\program files\Common Files\LapLink\Scheduler\LLSCHED.EXE"
              "SynTPLpr"=c:\program files\Synaptics\SynTP\SynTPLpr.exe
              "SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe
              "WorksFUD"=c:\program files\Microsoft Works\wkfud.exe
              "Microsoft Works Portfolio"=c:\program files\Microsoft Works\WksSb.exe /AllUsers
              "Microsoft Works Update Detection"=c:\program files\Microsoft Works\WkDetect.exe
              "seticlient"=c:\program files\SETI@home\[email protected] -min
              "TkBellExe"=c:\program files\Common Files\Real\Update_OB\realsched.exe -osboot
              "QuickTime Task"="c:\windows\SYSTEM32\qttask.exe" -atboottime
              "AOLDialer"=c:\program files\Common Files\AOL\ACS\AOLDial.exe
              "DadApp"=c:\program files\DELL\AccessDirect\dadapp.exe
              "BayMgr"=DockApp.exe
              "AOL Spyware Protection"="c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
              "HostManager"=c:\program files\Common Files\AOL\1106251464\EE\AOLHostManager.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
              "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
              "Promon.exe"=Promon.exe
              "CPortPatch"=c:\windows\Quick Install\CPPatch.exe
              "PRPCMonitor"=PRPCUI.exe
              "LoadQM"=loadqm.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
              "SchedulingAgent"=mstask.exe
              "AolAcsDaemon1"="c:\program files\COMMON FILES\AOL\ACS\AOLACSD.EXE"
              "AOL TopSpeedMonitor"=c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
              "NVSvc"=c:\windows\SYSTEM32\NVSVC.EXE -runservice
              "KB891711"=c:\windows\SYSTEM\KB891711\KB891711.EXE
              "MSNIA"=c:\progra~1\MSN\MSNIA\MSNIASVC.EXE

              [HKEY_LOCAL_MACHINE\software\microsoft\security center]
              "FirewallOverride"=dword:00000001

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
              "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
              "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
              "c:\\Program Files\\iTunes\\iTunes.exe"=

              R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [5/15/2008 11:17 AM 325128]
              R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [5/15/2008 11:17 AM 107272]
              R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
              R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
              R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/19/2009 1:43 PM 903960]
              R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/19/2009 1:43 PM 298264]
              R2 Nhksrv;Netropa NHK Server;c:\windows\Nhksrv.exe [12/1/2006 12:30 PM 28672]
              R3 maestro;ESS Maestro Audio Driver (WDM);c:\windows\SYSTEM32\DRIVERS\es198xdl.sys [6/20/2002 5:53 PM 414400]
              R3 Msikbd2k;DellTouch;c:\windows\SYSTEM32\DRIVERS\Msikbd2k.sys [12/1/2006 12:30 PM 6942]
              S3 AWINDIS5;AWINDIS5 Protocol Driver;c:\windows\SYSTEM32\AWINDIS5.SYS [12/3/2006 1:40 PM 16194]
              S3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;c:\windows\SYSTEM32\DRIVERS\wg511nd5.sys [12/3/2006 1:39 PM 449888]
              S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
              HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
              rundll rnasetup.dll,installoptionalcomponent rna

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
              "c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
              c:\windows\SYSTEM32\updcrl.exe -e -u c:\windows\SYSTEM\verisignpub1.crl
              .
              Contents of the 'Scheduled Tasks' folder
              .
              - - - - ORPHANS REMOVED - - - -

              BHO-{5DC51E2A-2041-4745-97BA-1CA8C794A07F} - c:\program files\Internet Explorer\LiveInfoPro\toolbar_v0.9.5_w-jsinside-affid-1002.dll
              Toolbar-{3E9D340B-D614-4854-AE06-4218201F6AAE} - c:\program files\Internet Explorer\LiveInfoPro\toolbar_v0.9.5_w-jsinside-affid-1002.dll
              HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
              HKLM-Run-AOLDialer - c:\program files\Common Files\AOL\ACS\AOLDial.exe
              HKU-Default-Run-InetChk - c:\windows\TEMP\ms1242158271.exe


              .
              ------- Supplementary Scan -------
              .
              uStart Page = hxxp://yahoo.com/
              mLocal Page = c:\windows\SYSTEM\blank.htm
              mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
              uInternet Connection Wizard,ShellNext = hxxp://cf.icq.com/cf/2000/lost_password.html
              uInternet Settings,ProxyServer = http=localhost:7171
              uInternet Settings,ProxyOverride = *.local;<local>
              uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
              Trusted Zone: aol.com\free
              Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
              DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
              DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
              DPF: Win32 Classes
              DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - hxxp://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
              .

              **************************************************************************

              catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2009-05-15 01:41
              Windows 5.1.2600 Service Pack 2 FAT NTAPI

              scanning hidden processes ... 

              scanning hidden autostart entries ...

              scanning hidden files ... 

              scan completed successfully
              hidden files: 0

              **************************************************************************
              .
              --------------------- DLLs Loaded Under Running Processes ---------------------

              - - - - - - - > 'winlogon.exe'(684)
              c:\program files\SUPERAntiSpyware\SASWINLO.dll
              .
              Completion time: 2009-05-15  1:43
              ComboFix-quarantined-files.txt  2009-05-15 05:43

              Pre-Run: 8,631,222,272 bytes free
              Post-Run: 9,237,594,112 bytes free

              WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
              [boot loader]
              timeout = 30
              default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
              [operating systems]
              c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
              multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

              254   --- E O F ---   2009-05-08 16:44


              [attachment deleted by admin]

              evilfantasy

              • Malware Removal Specialist
              • Moderator


              • Genius
              • Calm like a bomb
              • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: malware removal guide
              « Reply #11 on: May 15, 2009, 11:30:20 AM »


              Open HijackThis and select Do a system scan only

              Vista users right click on HijackThis and select Run as Administrator. (you will receive a UAC prompt, please allow it)

              Place a check mark next to the following entries: (if there)

              • O2 - BHO: TBSB00583 - {5DC51E2A-2041-4745-97BA-1CA8C794A07F} - C:\Program Files\Internet Explorer\LiveInfoPro\toolbar_v0.9.5_w-jsinside-affid-1002.dll (file missing)
              • O3 - Toolbar: LiveInfoPro - {3E9D340B-D614-4854-AE06-4218201F6AAE} - C:\Program Files\Internet Explorer\LiveInfoPro\toolbar_v0.9.5_w-jsinside-affid-1002.dll (file missing)
              • O16 - DPF: Win32 Classes -
              .
              Important: Close all open windows except for HijackThis and then click Fix checked.

              Once completed, exit HijackThis.

              ----------

              Download the OTMoveIt3 by OldTimer

              Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

              * Save it to your Desktop.
              * Double-click OTMoveIt3.exe to run it.
              * Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

              Code: [Select]
              :Processes
              explorer.exe

              :services

              :reg

              :files
              C:\FOUND.001

              :Commands
              [purity]
              [emptytemp]
              [start explorer]

              * Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
              * Click the red Moveit! button.
              * Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
              Close OTMoveIt3

              Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes.

              ----------

              • Click START then RUN
              • Now type Combofix /u in the runbox
              • Make sure there's a space between Combofix and /u
              • Then hit Enter.
              .
              .
              The above procedure will:
              • Delete: ComboFix and its associated files and folders.
              • Reset the clock settings.
              • Hide file extensions, if required.
              • Hide System/Hidden files, if required.
              • Set a new, clean Restore Point.
              .
              ----------

              1. Double click OTMoveIt3.exe to launch it.
              Vista users right click and choose Run As Administrator
              2. Click on the CleanUp! button.
              3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
              4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
              5. Once complete exit out of OTMoveIt3

              ----------

              Use the ESET Online Antivirus Scanner

              This scanner requires Internet Explorer

              1. Check the box next to YES, I accept the Terms of Use.
              2. Click Start
              3. When asked, allow the activex control to install
              4. Click Start
              5. Make sure that the option Remove found threats and the option Scan unwanted applications is check marked.
              6. Click Scan
              7. Wait for the scan to finish
              8. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
              9. Add the C:\Program Files\EsetOnlineScanner\log.txt log into your next reply.

              notevenclose

                Topic Starter


                Rookie

                Re: malware removal guide
                « Reply #12 on: May 16, 2009, 04:39:41 PM »


                here are my latest logs




                ========== PROCESSES ==========
                Process explorer.exe killed successfully.
                ========== SERVICES/DRIVERS ==========
                ========== REGISTRY ==========
                ========== FILES ==========
                C:\FOUND.001 moved successfully.
                ========== COMMANDS ==========
                User's Temp folder emptied.
                User's Internet Explorer cache folder emptied.
                File delete failed. C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                User's Temporary Internet Files folder emptied.
                Local Service Temp folder emptied.
                File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                Local Service Temporary Internet Files folder emptied.
                Network Service Temp folder emptied.
                Network Service Temporary Internet Files folder emptied.
                File delete failed. C:\WINDOWS\temp\dfbd20b3-b0c5-4470-b454-1feee20ee01a.tmp scheduled to be deleted on reboot.
                Windows Temp folder emptied.
                Temp folders emptied.
                Explorer started successfully
                 
                OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05162009_133548

                Files moved on Reboot...
                File C:\WINDOWS\temp\dfbd20b3-b0c5-4470-b454-1feee20ee01a.tmp not found!




                # version=4
                # OnlineScanner.ocx=1.0.0.635
                # OnlineScannerDLLA.dll=1, 0, 0, 79
                # OnlineScannerDLLW.dll=1, 0, 0, 78
                # OnlineScannerUninstaller.exe=1, 0, 0, 49
                # vers_standard_module=4080 (20090515)
                # vers_arch_module=1.064 (20080214)
                # vers_adv_heur_module=1.066 (20070917)
                # EOSSerial=83bff9a9d9d396428ed4da6cef4c835f
                # end=finished
                # remove_checked=true
                # unwanted_checked=true
                # utc_time=2009-05-16 07:05:20
                # local_time=2009-05-16 03:05:20 (-0500, Eastern Daylight Time)
                # country="United States"
                # osver=5.1.2600 NT Service Pack 2
                # scanned=176763
                # found=0
                # scan_time=3664



                evilfantasy

                • Malware Removal Specialist
                • Moderator


                • Genius
                • Calm like a bomb
                • Thanked: 493
                • Experience: Experienced
                • OS: Windows 11
                Re: malware removal guide
                « Reply #13 on: May 16, 2009, 04:43:20 PM »
                Looks good.

                How is the computer running now?

                notevenclose

                  Topic Starter


                  Rookie

                  Re: malware removal guide
                  « Reply #14 on: May 16, 2009, 08:32:58 PM »
                    Seems good, fast ..I can't thank you enough!