Redirected searches and unwanted web pages popping up

Hi Kevin,

Thanks for helping.  I hope you are still up for it.  I took a long time to respond because I was hoping that the HIJACKTHIS log would be useful to someone and I could get help using that log instead of installing and running a new program.  Anyways, I finally downloaded TDS Killer and ran it.  The log is pasted below.

I look forward to hearing from you, and thanks again for your help.  I have not used my laptop for over a month now.

Here is the log:

21:24:45:984 2728 TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49
21:24:45:984 2728 ================================================================================
21:24:45:984 2728 SystemInfo:

21:24:45:984 2728 OS Version: 5.1.2600 ServicePack: 3.0
21:24:45:984 2728 Product type: Workstation
21:24:45:984 2728 ComputerName: SHARAD-LAP
21:24:45:984 2728 UserName: owner
21:24:45:984 2728 Windows directory: C:\WINDOWS
21:24:45:984 2728 System windows directory: C:\WINDOWS
21:24:45:984 2728 Processor architecture: Intel x86
21:24:45:984 2728 Number of processors: 2
21:24:45:984 2728 Page size: 0x1000
21:24:45:984 2728 Boot type: Normal boot
21:24:45:984 2728 ================================================================================
21:24:46:265 2728 Initialize success
21:24:46:265 2728 
21:24:46:265 2728 Scanning Services ...
21:24:47:593 2728 Raw services enum returned 359 services
21:24:47:609 2728 
21:24:47:609 2728 Scanning Drivers ...
21:24:48:640 2728 ACPI            (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:24:48:859 2728 ACPIEC          (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:24:49:187 2728 aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:24:49:359 2728 AegisP          (15e655baa989444f56787ef558823643) C:\WINDOWS\system32\DRIVERS\AegisP.sys
21:24:49:468 2728 AFD             (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
21:24:49:546 2728 Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:24:49:593 2728 AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:24:49:625 2728 atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:24:49:656 2728 Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:24:49:687 2728 audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:24:49:750 2728 bcm4sbxp        (e727776a56a51b7e6b7c87c02ea8b405) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
21:24:49:765 2728 Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:24:49:812 2728 bnxpuo          (e6d35f3aa51a65eb35c1f2340154a25e) C:\WINDOWS\system32\drivers\ebcarxu.sys
21:24:49:843 2728 cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:24:49:875 2728 CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:24:49:906 2728 Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:24:49:921 2728 Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:24:49:968 2728 Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:24:49:984 2728 cercsr6         (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys
21:24:50:031 2728 CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:24:50:062 2728 Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:24:50:093 2728 Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:24:50:140 2728 dmboot          (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:24:50:218 2728 dmio            (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:24:50:234 2728 dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:24:50:234 2728 DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:24:50:265 2728 drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:24:50:281 2728 Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:24:50:328 2728 Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:24:50:343 2728 Fips            (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:24:50:359 2728 Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:24:50:390 2728 FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:24:50:453 2728 FlyUsb          (8efa9bfc940d9eb9348d9dafb839fe25) C:\WINDOWS\system32\DRIVERS\FlyUsb.sys
21:24:50:468 2728 Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:24:50:484 2728 Ftdisk          (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:24:50:531 2728 GEARAspiWDM     (5dc17164f66380cbfefd895c18467773) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
21:24:50:562 2728 Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:24:50:593 2728 HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:24:50:609 2728 HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:24:50:734 2728 HSF_DPV         (e8ec1767ea315a39a0dd8989952ca0e9) C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys
21:24:50:765 2728 HSXHWAZL        (61478fa42ee04562e7f11f4dca87e9c8) C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys
21:24:50:812 2728 HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:24:50:890 2728 i8042prt        (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:24:50:968 2728 ialm            (bb39146eaeaa07d3ea2ef0d07c8f9d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:24:51:046 2728 Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:24:51:078 2728 intelppm        (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:24:51:109 2728 Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:24:51:140 2728 IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:24:51:156 2728 IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:24:51:187 2728 IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:24:51:203 2728 IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:24:51:296 2728 IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:24:51:312 2728 isapnp          (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:24:51:328 2728 Kbdclass        (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:24:51:359 2728 klmd23          (316353165feba3d0538eaa9c2f60c5b7) C:\WINDOWS\system32\drivers\klmd.sys
21:24:51:390 2728 kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:24:51:421 2728 KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:24:51:500 2728 mdmxsdk         (e246a32c445056996074a397da56e815) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
21:24:51:546 2728 mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:24:51:593 2728 Modem           (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:24:51:609 2728 Mouclass        (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:24:51:656 2728 mouhid          (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:24:51:718 2728 MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:24:51:750 2728 MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:24:51:796 2728 MRxSmb          (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:24:51:828 2728 Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:24:51:859 2728 MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:24:51:921 2728 MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:24:51:937 2728 MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:24:51:984 2728 mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:24:52:000 2728 MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
21:24:52:031 2728 Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
21:24:52:062 2728 NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:24:52:109 2728 NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:24:52:171 2728 NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:24:52:187 2728 NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:24:52:203 2728 Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:24:52:218 2728 NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:24:52:250 2728 NDProxy         (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
21:24:52:250 2728 NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:24:52:281 2728 NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:24:52:375 2728 NETw3x32        (a56b2f88318fd321da8e5be95a92296e) C:\WINDOWS\system32\DRIVERS\NETw3x32.sys
21:24:52:453 2728 NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:24:52:484 2728 Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:24:52:515 2728 Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:24:52:562 2728 Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:24:52:609 2728 NWADI           (67fb86eeb94059177642050718d57460) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
21:24:52:687 2728 NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:24:52:703 2728 NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:24:52:718 2728 NWUSBModem      (4e651808b35656ac88a4dcdaf6cc1169) C:\WINDOWS\system32\DRIVERS\nwusbmdm.sys
21:24:52:734 2728 NWUSBPort       (4e651808b35656ac88a4dcdaf6cc1169) C:\WINDOWS\system32\DRIVERS\nwusbser.sys
21:24:52:781 2728 ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:24:52:828 2728 OMCI            (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
21:24:52:843 2728 Parport         (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
21:24:52:859 2728 PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:24:52:890 2728 ParVdm          (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:24:52:937 2728 PCI             (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:24:52:968 2728 PCIIde          (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:24:53:000 2728 Pcmcia          (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:24:53:109 2728 PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:24:53:125 2728 PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:24:53:140 2728 Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:24:53:171 2728 PxHelp20        (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:24:53:234 2728 RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:24:53:265 2728 Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:24:53:312 2728 RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:24:53:343 2728 Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:24:53:375 2728 Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:24:53:390 2728 RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:24:53:437 2728 rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:24:53:453 2728 RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
21:24:53:484 2728 redbook         (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:24:53:515 2728 rimmptsk        (24ed7af20651f9fa1f249482e7c1f165) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
21:24:53:578 2728 rimsptsk        (1bdba2d2d402415a78a4ba766dfe0f7b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
21:24:53:593 2728 rismxdp         (f774ecd11a064f0debb2d4395418153c) C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
21:24:53:656 2728 s24trans        (2862adb14481ac28f98105ff33a99eb0) C:\WINDOWS\system32\DRIVERS\s24trans.sys
21:24:53:687 2728 sdbus           (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
21:24:53:718 2728 Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:24:53:812 2728 Ser2pl          (b490ad520257dda26c1d587a71e527b5) C:\WINDOWS\system32\DRIVERS\ser2pl.sys
21:24:53:843 2728 Serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:24:53:875 2728 Serial          (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
21:24:53:890 2728 sffdisk         (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
21:24:53:921 2728 sffp_sd         (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
21:24:53:953 2728 Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:24:53:984 2728 SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:24:54:125 2728 splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:24:54:140 2728 sr              (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:24:54:171 2728 Srv             (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
21:24:54:265 2728 STHDA           (3ad78e22210d3fbd9f76de84a8df19b5) C:\WINDOWS\system32\drivers\sthda.sys
21:24:54:343 2728 streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:24:54:375 2728 swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:24:54:500 2728 swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:24:54:640 2728 SynTP           (24f75b01c02992ad2e800b387269c50d) C:\WINDOWS\system32\DRIVERS\SynTP.sys
21:24:54:656 2728 sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:24:54:718 2728 Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:24:54:796 2728 TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:24:54:812 2728 TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:24:54:843 2728 TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:24:54:890 2728 Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:24:54:937 2728 Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:24:54:968 2728 usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:24:55:000 2728 usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:24:55:062 2728 usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:24:55:109 2728 usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:24:55:140 2728 USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:24:55:156 2728 usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:24:55:171 2728 usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
21:24:55:203 2728 VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:24:55:234 2728 VolSnap         (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:24:55:250 2728 Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:24:55:328 2728 wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:24:55:390 2728 winachsf        (ba6b6fb242a6ba4068c8b763063beb63) C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys
21:24:55:437 2728 WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
21:24:55:484 2728 WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:24:55:531 2728 WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:24:55:562 2728 WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:24:55:593 2728 WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:24:55:593 2728 
21:24:55:593 2728 Completed
21:24:55:593 2728 
21:24:55:593 2728 Results:
21:24:55:593 2728 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
21:24:55:593 2728 File objects infected / cured / cured on reboot: 0 / 0 / 0
21:24:55:593 2728 
21:24:55:593 2728 KLMD(ARK) unloaded successfully

Hi Rod714 I'm kevinf80 and I will be helping with any issues you may have. Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies. Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use. Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together. Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin. Please proceed as follows :- Download TDSSKILLER and save it to your Desktop. Extract the file and run it. Once completed it will create a log in your C:\ drive Please post the contents of that log in next reply If asked to re-boot, please do so I`d also like to see the TDSSKiller log, it will look similar to this TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt and will be located on your C:\ drive. START > My Comp > C:\TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt Copy/paste to reply if applicable Kevin

Hi Rod714,

HJT logs are useful as a starting point, but do not give a full picture of your system or what is happening. Your symptoms are common and did indicate possible TDL3 infection, hence my request to run TDSSKiller. Unforunately this was not the case and we`ll have to try a broader approach. Do not be concerned about running these new scans, we use these tools every day on many systems to assist with the malware cleansing process.

Please proceed as follows :-

Step 1

Please download Malwarebytes Anti-Malware and save it to your desktop.
Alernative D/L mirror
Alternative D/L mirror

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to ALLOW the changes. Instructions available HERE

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
• Update Malwarebytes' Anti-Malware
• Launch Malwarebytes' Anti-Malware

Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from HERE and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Step 2

CF. Primary speech

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: Combofix

Don`t forget Combofix must be saved to your desktop. <--Very important

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review.

Note: Do not click combofix's window with your mouse while it's running. That action may cause it to stall.

Examples of how to disable realtime protection available at the following link :-

Disable realtime protection

Step 3

Download Security Check by screen317 from HERE or HERE.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step 4

Your version of HJT is outdated, please uninstall it from Add/Remove Programs via the Control Panel. Next reinstall as follows:

Click here to download HJTInstaller Version 2.0.4

• Save HJTInstaller to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

What i`d like to see in your reply :-

• Log from Malwarebytes
• Log from Combofix
• Log from Security Checks
• Fresh HJT log

Kevin.

Kevin,

I think I may have made another mistake:  I actually ran TDS Killer two times and I posted only the second log.  It did find something the first time, and I had to reboot for TDS Killer to get rid of whatever it was.  Then, I ran TDS again, and posted that log.  I am currently out of town, and I do not have my laptop, but it was running pretty well yesterday.  When I get back, if I continue to have problems, I will post the log from my first run of TDS Killer (or should I just follow the instructions you gave above?).

Thanks very much for your help...I can't believe you responded so quickly!  Just curious:  What is your motivation for helping in this forum?

Rod.

Hi Rod,

If you werre infected with TDL3 it is quite probable, but not definite; that you will have a lot of secondary infections onboard. With that in mind i`d still like you to follow the previous instructions. Better safe than sorry.

You ask what motivates me, I only  come here occasionally, my home site is SpywareHammer. I guess just knowing you`ve helped someone makes it worthwhile, especially when they say thanks at the end.

Kevin

Kevin,

Thanks for your continued support.  My computer seems to be working well, but I am following your advice anyways.  Here are my logs:

Here is my log from Malware Bytes:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4314

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/14/2010 4:58:49 PM

mbam-log-2010-07-14 (16-58-49).txt

Scan type: Quick scan

Objects scanned: 139940

Time elapsed: 8 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\owner\Local Settings\Temp\0.4386760666087387.exe (Trojan.Insain) -> Quarantined and deleted successfully.

C:\Documents and Settings\owner\Local Settings\Temp\jar_cache64118.tmp (Trojan.Insain) -> Quarantined and deleted successfully.

C:\tujserrew.bat (Malware.Trace) -> Quarantined and deleted successfully.

Here is the log from Combofix:

ComboFix 10-07-14.02 - owner 07/14/2010  22:17:27.1.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1582 [GMT -7:00]

Running from: c:\documents and settings\owner\Desktop\ComboFix.exe

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\owner\g2mdlhlpx.exe

c:\documents and settings\owner\Local Settings\Application Data\Windows Server

c:\documents and settings\owner\Local Settings\Application Data\Windows Server\flags.ini

c:\documents and settings\owner\Local Settings\Application Data\Windows Server\uses32.dat

c:\documents and settings\owner\Local Settings\Temporary Internet Files\TestBrowser.html

c:\documents and settings\owner\Start Menu\Programs\Antimalware Doctor

c:\documents and settings\owner\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk

c:\documents and settings\owner\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk

C:\feed.txt

C:\install.exe

c:\windows\system32\Drivers\ebcarxu.sys

c:\windows\system32\gotomon.log

.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Service_6to4

-------\Legacy_bnxpuo

-------\Service_bnxpuo

(((((((((((((((((((((((((   Files Created from 2010-06-15 to 2010-07-15  )))))))))))))))))))))))))))))))

.

2010-07-14 21:37 . 2010-06-14 14:31            744448            -c----w-            c:\windows\system32\dllcache\helpsvc.exe

2010-07-14 21:30 . 2010-05-06 10:41            743424            -c----w-            c:\windows\system32\dllcache\iedvtool.dll

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-14 23:46 . 2010-05-02 04:38            --------  d-----w-           c:\program files\Spybot - Search & Destroy

2010-07-14 23:25 . 2010-05-02 04:38            --------  d-----w-           c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-07-14 23:19 . 2010-04-27 16:56            --------  d-----w-           c:\program files\Malwarebytes' Anti-Malware

2010-07-10 04:22 . 2004-08-04 10:00            3328    ----a-w-            c:\windows\system32\drivers\pciide.sys

2010-07-10 04:07 . 2008-09-01 06:54            --------  d-----w-           c:\program files\Spyware Doctor

2010-07-10 04:03 . 2008-09-01 06:54            --------  d---a-w-           c:\documents and settings\All Users\Application Data\TEMP

2010-06-14 14:31 . 2006-10-20 23:54            744448            ----a-w-            c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-05 21:51 . 2010-06-05 21:51            --------  d-----w-           c:\documents and settings\PBA Staff\Application Data\Malwarebytes

2010-05-21 07:57 . 2010-05-21 07:57            --------  d-----w-           c:\program files\Trend Micro

2010-05-06 10:41 . 2006-03-04 03:33            916480            ----a-w-            c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2004-08-04 10:00            1851264          ----a-w-            c:\windows\system32\win32k.sys

2010-04-29 22:39 . 2010-04-27 16:56            38224  ----a-w-            c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39 . 2010-04-27 16:56            20952  ----a-w-            c:\windows\system32\drivers\mbam.sys

2010-04-20 05:30 . 2004-08-04 10:00            285696            ----a-w-            c:\windows\system32\atmfd.dll

.

c:\program files\Citrix\GoToMeeting\366\g2mstart .exe

c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe

c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe

c:\program files\Intel\Wireless\Bin\ifrmewrk .exe

c:\program files\Intel\Wireless\Bin\zcfgsvc .exe

c:\program files\iTunes\ituneshelper .exe

c:\program files\Java\jre1.6.0_02\bin\jusched .exe

c:\program files\LeapFrog\LeapFrog Connect\monitor .exe

c:\program files\QuickTime\qttask       .exe

c:\program files\Synaptics\SynTP\syntpenh .exe

c:\program files\Synaptics\SynTP\syntplpr .exe

c:\windows\system32\ctfmon .exe

c:\windows\system32\hkcmd .exe

c:\windows\system32\igfxpers .exe

c:\windows\system32\igfxtray .exe

c:\windows\system32\regsvr32 .exe

c:\windows\system32\rundll32 .exe

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Tweak UI"="TWEAKUI.CPL" [2000-06-26 102256]

"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

S0 abcdxq;abcdxq;

S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/2/2010 10:36 AM 18560]

S3 memchek;memchek;\??\c:\windows\system32\memchek.sys --> c:\windows\system32\memchek.sys [?]

.

Contents of the 'Scheduled Tasks' folder

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 00:57]

2010-01-22 c:\windows\Tasks\Norton Security Scan for owner.job

- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2010-01-22 00:45]

2010-07-15 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAEXEC.exe [2009-08-03 22:07]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_93C8148BBB233F43.dll/cmsidewiki.html

DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB

.

- - - - ORPHANS REMOVED - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

SafeBoot-klmdb.sys

AddRemove-TweakUI - c:\windows\rundll32.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-14 22:26

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(812)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-07-14  22:30:25 - machine was rebooted

ComboFix-quarantined-files.txt  2010-07-15 05:30

Pre-Run: 29,209,681,920 bytes free

Post-Run: 29,463,293,952 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

-          - End Of File - - 633439254496A7364D688786F6B102C2

Here is the log from Security Check.exe

Results of screen317's Security Check version 0.99.4 

 Windows XP Service Pack 3 

 Internet Explorer 8 

``````````````````````````````

Antivirus/Firewall Check:

 Windows Firewall Disabled! 

 WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

 Malwarebytes' Anti-Malware   

 Java(TM) 6 Update 2 

 Out of date Java installed!

 Adobe Flash Player 10.0.42.34 

Adobe Reader 9.2

Out of date Adobe Reader installed!

````````````````````````````````

Process Check: 

objlist.exe by Laurent

````````````````````````````````

DNS Vulnerability Check:

 GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Here is the log from Hijack This

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:50:19 PM, on 7/14/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O3 - Toolbar: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - (no file)

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (rootkit-scan)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_93C8148BBB233F43.dll/cmsidewiki.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CAB

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--

End of file - 5018 bytes

Kevin,

Kevin,

I’m curious, are all these files (see below) infected?  I recognize many of these as programs I have used before (LeapFrog, GoToMeeting, Adobe, Quicktime, Itunes...

c:\program files\Citrix\GoToMeeting\366\g2mstart .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\Intel\Wireless\Bin\ifrmewrk .exe
c:\program files\Intel\Wireless\Bin\zcfgsvc .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre1.6.0_02\bin\jusched .exe
c:\program files\LeapFrog\LeapFrog Connect\monitor .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Synaptics\SynTP\syntplpr .exe
c:\windows\system32\ctfmon .exe
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxpers .exe
c:\windows\system32\igfxtray .exe
c:\windows\system32\regsvr32 .exe
c:\windows\system32\rundll32 .exe

Hi Rod,

I know that part of the fix can be confusing, the infection has altered those programs for its own purpose. Lets just look at the first one in the list as an example:

1. c:\program files\Citrix\GoToMeeting\366\g2mstart .exe

2. c:\program files\Citrix\GoToMeeting\366\g2mstart.exe

In example no.1 note the space between mstart and .exe, In example no.2 note there is no space. Example no. 2 is the way that file should be presented on your system.

Combofix will attempt to remove the infected file and replace it with a clean one (if found) If there isn`t one available you will have to re-install that particular program.

Does that clarify that point for you?

Kevin

Kevin,

Ok....I ran the two programs (combofix and Kaspersky).  The reprots still seem rather long.  Is my computer really messed up?  One thing that I did not think was related, but now I'm concerned is that my MS Office software started to give me a notice saying that it is not authentic.  The software came with my computer, and it's from Dell, and I never used to receive the notice until about a month ago.  Is this a related matter or should I just reinstall the software?

The reports are pasted below...

Here is my log from combofix:

ComboFix 10-07-15.03 - owner 07/15/2010  23:16:58.2.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1466 [GMT -7:00]

Running from: c:\documents and settings\owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\owner\Desktop\CFScript.txt

FILE ::

"c:\windows\system32\memchek.sys"

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABCDXQ

-------\Legacy_MEMCHEK

-------\Service_abcdxq

-------\Service_memchek

(((((((((((((((((((((((((   Files Created from 2010-06-16 to 2010-07-16  )))))))))))))))))))))))))))))))

.

2010-07-16 01:17 . 2010-07-16 01:17            --------  d-sh--w-          c:\documents and settings\Default User\IETldCache

2010-07-15 05:49 . 2010-07-15 05:49            388096            ----a-r-  c:\documents and settings\owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-07-14 21:37 . 2010-06-14 14:31            744448            -c----w-            c:\windows\system32\dllcache\helpsvc.exe

2010-07-14 21:30 . 2010-05-06 10:41            743424            -c----w-            c:\windows\system32\dllcache\iedvtool.dll

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-16 06:21 . 2007-08-09 04:33            --------  d-----w-           c:\program files\Microsoft Silverlight

2010-07-16 06:16 . 2008-01-01 00:27            --------  d-----w-           c:\program files\iTunes

2010-07-14 23:46 . 2010-05-02 04:38            --------  d-----w-           c:\program files\Spybot - Search & Destroy

2010-07-14 23:25 . 2010-05-02 04:38            --------  d-----w-           c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-07-14 23:19 . 2010-04-27 16:56            --------  d-----w-           c:\program files\Malwarebytes' Anti-Malware

2010-07-10 04:22 . 2004-08-04 10:00            3328    ----a-w-            c:\windows\system32\drivers\pciide.sys

2010-07-10 04:07 . 2008-09-01 06:54            --------  d-----w-           c:\program files\Spyware Doctor

2010-07-10 04:03 . 2008-09-01 06:54            --------  d---a-w-           c:\documents and settings\All Users\Application Data\TEMP

2010-06-14 14:31 . 2006-10-20 23:54            744448            ----a-w-            c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-05 21:51 . 2010-06-05 21:51            --------  d-----w-           c:\documents and settings\PBA Staff\Application Data\Malwarebytes

2010-05-21 07:57 . 2010-05-21 07:57            --------  d-----w-           c:\program files\Trend Micro

2010-05-06 10:41 . 2006-03-04 03:33            916480            ----a-w-            c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2004-08-04 10:00            1851264          ----a-w-            c:\windows\system32\win32k.sys

2010-04-29 22:39 . 2010-04-27 16:56            38224  ----a-w-            c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39 . 2010-04-27 16:56            20952  ----a-w-            c:\windows\system32\drivers\mbam.sys

2010-04-20 05:30 . 2004-08-04 10:00            285696            ----a-w-            c:\windows\system32\atmfd.dll

.

c:\program files\QuickTime\qttask       .exe

(((((((((((((((((((((((((((((   SnapShot@2010-07-15_05.26.26   )))))))))))))))))))))))))))))))))))))))))

.

+ 2006-10-23 23:33 . 2006-07-15 00:07         94208              c:\windows\system32\igfxtray.exe

+ 2006-10-23 23:33 . 2006-07-15 00:04         77824              c:\windows\system32\hkcmd.exe

+ 2010-07-16 01:17 . 2010-07-16 01:17         49152              c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll

+ 2006-10-23 23:33 . 2006-07-15 00:08         118784              c:\windows\system32\igfxpers.exe

+ 2010-07-15 05:49 . 2010-07-15 05:49         1094656              c:\windows\Installer\18fa3d.msi

+ 2010-07-16 01:16 . 2010-07-16 01:16         20242432              c:\windows\Installer\2055b.msp

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Tweak UI"="TWEAKUI.CPL" [2000-06-26 102256]

"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/2/2010 10:36 AM 18560]

.

Contents of the 'Scheduled Tasks' folder

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 00:57]

2010-01-22 c:\windows\Tasks\Norton Security Scan for owner.job

- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2010-01-22 00:45]

2010-07-16 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAEXEC.exe [2009-08-03 22:07]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_93C8148BBB233F43.dll/cmsidewiki.html

DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-15 23:24

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(572)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-07-15  23:28:20 - machine was rebooted

ComboFix-quarantined-files.txt  2010-07-16 06:28

ComboFix2.txt  2010-07-15 05:30

Pre-Run: 29,246,492,672 bytes free

Post-Run: 29,310,857,216 bytes free

-          - End Of File - - BEC1C3B7014FC97419B6F5D29D5A1812

HERE IS THE KASPERSKY REPORT:

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

 Friday, July 16, 2010

 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

 Kaspersky Online Scanner version: 7.0.26.13

 Last database update: Friday, July 16, 2010 05:22:37

 Records in database: 4225588

--------------------------------------------------------------------------------

Scan settings:

            scan using the following database: extended

            Scan archives: yes

            Scan e-mail databases: yes

Scan area - My Computer:

            C:\

            D:\

Scan statistics:

            Objects scanned: 66801

            Threats found: 9

            Infected objects found: 27

            Suspicious objects found: 0

            Scan duration: 02:10:22

File name / Threat / Threats count

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\19\623d3213-600979f8            Infected: Trojan-Downloader.Java.Agent.dm            1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\19\623d3213-600979f8            Infected: Trojan-Downloader.Java.Agent.dl  1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\19\623d3213-600979f8            Infected: Exploit.Java.Agent.e           1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\29\7adbb65d-5f44d2e5            Infected: Exploit.Java.Agent.f           1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\34\11da5462-4d987988            Infected: Trojan.Java.Agent.l 1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\34\11da5462-4d987988            Infected: Trojan-Downloader.Java.Agent.do 1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\34\11da5462-4d987988            Infected: Trojan-Downloader.Java.Agent.dn 1

C:\Documents and Settings\owner\Application Data\Sun\Java\Deployment\cache\6.0\59\6817a27b-374179c8            Infected: Trojan-Downloader.Java.Agent.al  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0PE3G9EV\ac[1].htm       Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0PE3G9EV\ac[2].htm       Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KHQRKXY7\ac[1].htm    Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KHQRKXY7\ac[2].htm    Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KPYNGT6Z\ac[1].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KPYNGT6Z\ac[2].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KPYNGT6Z\ac[3].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\acCAK9X6PK.htm Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[10].htm   Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[11].htm   Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[1].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[2].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[3].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[4].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[5].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac:emotion-14:.htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[7].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac:emotion-29:.htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WX6F8PAV\ac[9].htm     Infected: Trojan-Downloader.JS.Agent.cnn  1

Selected area has been scanned.

Hi Rod,

Yep you`ve had a very nasty infection onboard, I did think the best way forward may have been a re-format and re-install, but I think we`ve got it on the run now. Please proceed as follows :-

Step 1

Please uninstall the following from Add/Remove Programs via your control panel. (If you use Quicktime you will have to D/L and re-install again)

Quicktime

Step 2

Please download OTM by OldTimer. Save it to your desktop.

Double click OTM.exe to start the tool.

• Copy the text between the dotted lines below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  ----------------------------------------------------------------------
  
  :Processes
  explorer.exe
  
  :Files
  c:\program files\QuickTime
  :Commands
  [CreateRestorePoint]
  [EmptyFlash]
  [EmptyTemp]
  [Purity]
  [Reboot]
  
  ---------------------------------------------------------------------
• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

Step 3

Run online scan with Kaspersky again, I know its time taking but i`ve got to be sure you`re clean. Here are the instructions again...

Run an online virus scan with Kaspersky from HERE. This scan is very thorough and may take several hours to run, please allow it to complete.
1. At the main page. Press on "Accept". After reading the contents.
2. At the next window Select  Update. Allow the Database to update.
Note: If prompted to run or update your Java, then follow the prompts to do so. Kaspersky requires Java to run.
3. Once the Database has finished, under the Scan icon Select My Computer to start the scan. The scan may take a few minutes to complete.
4. Select Scan Report.
5. If any threats were found they will appear in the report
6. Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.
Copy and post the results of the Kaspersky Online scan. If no threats were found then report that as well.

The following animation may help.

Kaspersky Gif

Let me see logs from OTM and Kaspersky in your reply please. Also system update, any specific issues?

Regarding your query with MS office, reinstalling might not help. Read the info from this Link Let me know if that helps.

Kevin.

Kevin,

OK…the OTM.exe link was kind of scary, because I rec’d the warning below.  I downloaded anyways, the report is below, followed by the Kaspersky report.

As far as the current condition of my system:

During my last session, IE closed windows a couple of times.  But, I just reopened IE and it worked fine.  The problem has not occurred again.  Just now, I rebooted my system and went to logon to the Dell site.  After I entered my id and password, an extra tab inexplicably opened in IE.  The tab had links to supposed spyware software.  I closed the tab and continued getting to the forum.

My Office products are still having the issue about not being genuine, but I haven’t followed up with the link you sent yet.  After I post this reply, I will follow that link and I’ll update you.

I have also noticed that when I restart my laptop, a screen offering a choice of boot up options comes up (VERY briefly).  This screen did not used to come up.  It offers a choice between Microsoft Windows XP and Microsoft Recovery Console.  The default is XP and I don’t change it.  If this screen was appearing before, I never noticed it.  Does it mean anything?

HERE IS THE OTM.EXE REPORT:

All processes killed

========== PROCESSES ==========

No active process named explorer.exe was found!

========== FILES ==========

c:\program files\QuickTime folder moved successfully.

========== COMMANDS ==========

Error starting restore point: 5

Error closing restore point: 5

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 41703 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 439398 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 12289 bytes

User: owner

->Temp folder emptied: 107918742 bytes

->Temporary Internet Files folder emptied: 9909282 bytes

->Java cache emptied: 5868928 bytes

->Flash cache emptied: 467309 bytes

User: PBA Staff

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 282459 bytes

->Java cache emptied: 2276927 bytes

->Flash cache emptied: 965 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2195181 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 483 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 7323089 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 130.00 mb

OTM by OldTimer - Version 3.1.14.0 log created on 07162010_224001

Files moved on Reboot...

Registry entries deleted on Reboot...

HERE IS THE KASPERSKY REPORT:

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

 Saturday, July 17, 2010

 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

 Kaspersky Online Scanner version: 7.0.26.13

 Last database update: Saturday, July 17, 2010 04:16:51

 Records in database: 4227322

--------------------------------------------------------------------------------

Scan settings:

            scan using the following database: extended

            Scan archives: yes

            Scan e-mail databases: yes

Scan area - My Computer:

            C:\

            D:\

Scan statistics:

            Objects scanned: 64654

            Threats found: 1

            Infected objects found: 2

            Suspicious objects found: 0

            Scan duration: 02:09:02

File name / Threat / Threats count

C:\Documents and Settings\owner\Application Data\SystemProc\lsass.exe/C:\Documents and Settings\owner\Application Data\SystemProc\lsass.exe         Infected: Net-Worm.Win32.Koobface.gvl     1

C:\Documents and Settings\owner\Application Data\SystemProc\lsass.exe  Infected: Net-Worm.Win32.Koobface.gvl    1

Selected area has been scanned.

Hi Kevin,

Just another little update:  Right after I posted the info above, I decided to surf a little.  Went to youtube, clicked on a golf video by Robin Williams.  Instead of getting the video, I was redirected to Parenting.com (http://www.parenting.com/gallery/Mom/Celebrity-Single-Moms?ppc=adv&affiliate=itcg-20612).  That was wierd!  If there's a virus on my computer why does it want to redirect me to parenting.com?!?  What do the virus writers get out of all this anyway?

Thanks for helping,

Rod

Hi Rod,

Yep, nice job with MB, that is not unusual, as we strip away the Rootkit and infections other stuff shows up, probably the Rootkit was shielding stuff and that is why it was unseen before.

Step 1

• Re-open Malwarebytes and check for updates. I know you`ve just done it, Some times a second run is required.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step 2

Run ESET Online Scan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
• Double click on the icon on your desktop.

• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

You can refer to this animation by neomage if needed.
Frequently asked questions available Here

Let me see the logs from Malwarebytes and ESET in next reply please.

Regarding the bootup screen, yep Recovery Console is new, Combofix put it there. It is well worth keeping, We can use that for running commands to help recover unbootable systems if infected really bad.

Kev.

Kevin,

I couldn’t help but run Malware bytes again after the recent surfing incident.  It found some stuff and required a reboot to remove it.  Here is the log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4314

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/17/2010 8:02:52 AM

mbam-log-2010-07-17 (08-02-52).txt

Scan type: Quick scan

Objects scanned: 136538

Time elapsed: 6 minute(s), 20 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 4

Files Infected: 4

Memory Processes Infected:

C:\Documents and Settings\owner\Application Data\SystemProc\lsass.exe (Worm.KoobFace) -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rthdbpl (Worm.KoobFace) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Documents and Settings\owner\Application Data\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D} (Worm.Prolaco.M) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome (Worm.Prolaco.M) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content (Worm.Prolaco.M) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\owner\Application Data\SystemProc\lsass.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest (Worm.Prolaco.M) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf (Worm.Prolaco.M) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul (Worm.Prolaco.M) -> Quarantined and deleted successfully.