Computer won't let me execute files

Hi Dan,

I'm kevinf80 and I will be helping with any issues you may have. Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.
Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.

Please proceed as follows :-

Step 1

Please re-open HiJackThis and scan only.  Check the boxes next to all the entries listed below.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKCU\..\Run: [yenasuwuz] Rundll32.exe "c:\progra~2\zugezevu\zugezevu.dll",a
O20 - AppInit_DLLs: c:\windows\system32\gohulayo.dll c:\windows\system32\vulojedu.dll,C:\WINDOWS\system32\jayoriji.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL


Now close all windows other than HiJackThis, then click Fix Checked.  Close HiJackThis.  Reboot

Step 2

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Step 3

We will contiue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

Combofix

Don`t forget Combofix must be saved to your desktop. <--Very important

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. <---Very important

Please include the C:\ComboFix.txt in your next reply for further review.

Examples of how to disable realtime protection available at the following link :-

Disable realtime protection


Note: Do not click combofix's window with your mouse while it's running. That action may cause it to stall.

Step 4

Download Security Check by screen317 from HERE or HERE.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

What i`d like in your reply :-

• Log from exe helper
• Log from Combofix
• Log from Security Check

Kevin.

Thanks Kevin, I appreciate any and all help you can provide. I understand that you have a life outside of fixing my daughters problem.

I re-ran Hijack This and fixed what you advised.

I cannot however get the exehelper to download. It either fails on the download or says it's a bad page. I have tried on multiple computers with the same result??

I obviously don't want to move onto the Combofix until I have completed step 2

Any thoughts.

Dan

Okay, I got it to download by disabling my anti-virus software first.

Here is the exehelper.exe log:

exeHelper by Raktor
Build 20100414
Run at 20:38:51 on 07/22/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Removing HKCR\secfile
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Here is the ComboFix log:

ComboFix 10-07-22.01 - Mary Cait 07/22/2010  20:45:10.1.1 - x86
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.1.1033.18.2813.1943 [GMT -5:00]
Running from: c:\users\Mary Cait\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\1633618601.dll
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\14N8Dv.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\656J633E.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\GPAdrf.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\l0vgQN.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\lxbR5c3e.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\p8IaNc81K.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\RSApX.jpg
c:\users\Mary Cait\AppData\Local\Microsoft\Windows\Temporary Internet Files\XStfFmww.jpg
c:\windows\Tasks\ltsgqpmt.job
c:\windows\Tasks\ofrkbywr.job

.
(((((((((((((((((((((((((   Files Created from 2010-06-23 to 2010-07-23  )))))))))))))))))))))))))))))))
.

2010-07-23 01:54 . 2010-07-23 01:55    --------    d-----w-    c:\users\Mary Cait\AppData\Local\temp
2010-07-23 01:54 . 2010-07-23 01:54    --------    d-----w-    c:\users\Default\AppData\Local\temp
2010-07-23 01:54 . 2010-07-23 01:54    --------    d-----w-    c:\users\Administrator\AppData\Local\temp
2010-07-22 02:37 . 2010-07-22 02:37    --------    d-----w-    c:\program files\uTorrent
2010-07-22 02:29 . 2010-07-22 02:29    388096    ----a-r-    c:\users\Mary Cait\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-22 02:29 . 2010-07-22 02:29    --------    d-----w-    c:\program files\Trend Micro
2010-06-30 09:40 . 2010-06-30 09:42    --------    d-----w-    c:\program files\QuickTime
2010-06-30 09:31 . 2010-06-30 09:32    --------    d-----w-    c:\program files\Bonjour
2010-06-30 09:24 . 2010-06-30 09:24    71992    ----a-w-    c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-24 21:01 . 2010-06-21 19:00    501936    ----a-w-    c:\programdata\Google\Google Toolbar\Update\gtb39F7.tmp.exe
2010-06-23 15:46 . 2009-11-08 15:55    99176    ----a-w-    c:\windows\system32\PresentationHostProxy.dll
2010-06-23 15:46 . 2009-11-08 15:55    295264    ----a-w-    c:\windows\system32\PresentationHost.exe
2010-06-23 15:46 . 2009-11-08 15:55    49472    ----a-w-    c:\windows\system32\netfxperf.dll
2010-06-23 15:46 . 2009-11-08 15:55    297808    ----a-w-    c:\windows\system32\mscoree.dll
2010-06-23 15:46 . 2009-11-08 15:55    1130824    ----a-w-    c:\windows\system32\dfshim.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-23 00:13 . 2009-05-18 23:55    --------    d-----w-    c:\users\Mary Cait\AppData\Roaming\LimeWire
2010-07-22 21:53 . 2009-04-16 03:06    --------    d-----w-    c:\users\Mary Cait\AppData\Roaming\uTorrent
2010-07-16 22:04 . 2006-11-02 11:18    --------    d-----w-    c:\program files\Windows Mail
2010-07-16 21:57 . 2008-12-04 12:42    --------    d-----w-    c:\programdata\Microsoft Help
2010-06-30 09:27 . 2010-02-16 03:50    --------    d-----w-    c:\program files\Safari
2010-06-26 08:02 . 2009-04-15 02:09    --------    d-----w-    c:\program files\Microsoft.NET
2010-06-18 19:44 . 2009-04-14 13:25    --------    d-----w-    c:\program files\McAfee
2010-06-08 02:14 . 2010-05-10 18:30    --------    d-----w-    c:\program files\Microsoft Silverlight
2010-06-03 19:27 . 2009-05-19 21:41    34    ----a-w-    c:\windows\system32\BD7020.DAT
2010-05-26 17:06 . 2010-06-10 01:59    34304    ----a-w-    c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-10 01:59    289792    ----a-w-    c:\windows\system32\atmfd.dll
2010-05-21 19:14 . 2009-10-02 17:26    221568    ------w-    c:\windows\system32\MpSigStub.exe
2010-05-18 21:35 . 2010-05-18 21:35    91424    ----a-w-    c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35    197920    ----a-w-    c:\windows\system32\dnssdX.dll
2010-05-18 21:35 . 2010-05-18 21:35    107808    ----a-w-    c:\windows\system32\dns-sd.exe
2010-05-04 05:59 . 2010-06-10 01:59    916480    ----a-w-    c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-10 01:59    109056    ----a-w-    c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-10 01:59    71680    ----a-w-    c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-10 01:59    133632    ----a-w-    c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-10 01:59    2037248    ----a-w-    c:\windows\system32\win32k.sys
2009-11-02 23:56 . 2009-11-02 23:56    119808    ----a-w-    c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-14 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-07-23 846344]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-02 30192]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"Acer Assist Launcher"="c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"TDxVGAUTIL"="c:\windows\system32\TDxVGAUTIL.EXE" [2007-08-01 237568]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-03-29 1086856]
"Skytel"="Skytel.exe" [2008-06-25 1826816]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):46,9f,da,38,86,d6,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-02 135664]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-26 131072]
R3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\DRIVERS\ADM851X.SYS [2003-12-19 27135]
R3 GoogleDesktopManager-093009-130223;Google Desktop Manager 5.9.909.30391;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-02 30192]
R3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.sys [2007-08-01 33280]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-11-28 24576]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-12-08 93320]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-26 45056]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032]
S3 TdxMrMINI;TdxMrMINI;c:\windows\system32\DRIVERS\TdxMrMini.sys [2007-08-01 249600]
S3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\DRIVERS\TdxVgaMini.sys [2007-08-01 252160]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork    REG_MULTI_SZ       PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation    REG_MULTI_SZ       FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-02 22:58]

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-02 22:58]

2010-07-17 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 17:22]

2010-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 17:22]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: microsoft.com\office
FF - ProfilePath - c:\users\Mary Cait\AppData\Roaming\Mozilla\Firefox\Profiles\fvj3i42p.default\
FF - prefs.js: browser.startup.homepage - www.blackle.com
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 20:55
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-07-22  21:00:10
ComboFix-quarantined-files.txt  2010-07-23 01:59

Pre-Run: 5,555,830,784 bytes free
Post-Run: 5,710,532,608 bytes free

- - End Of File - - EF6BB039102149A35A8486F72E74065D

And here is the Security Check log:

 Results of screen317's Security Check version 0.99.4 
 Windows Vista Service Pack 2 (UAC is enabled)
 Internet Explorer 8 
``````````````````````````````
Antivirus/Firewall Check:
 Windows Firewall Disabled! 
 McAfee SecurityCenter    
 WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 Java(TM) 6 Update 13 
 Out of date Java installed!
 Adobe Flash Player 10.0.45.2 
Adobe Reader 9
Out of date Adobe Reader installed!
````````````````````````````````
Process Check: 
objlist.exe by Laurent
 McAfee VIRUSS~1 mcshield.exe 
 McAfee VIRUSS~1 mcsysmon.exe 
 mcafee VIRUSS~1 mcvsshld.exe 
````````````````````````````````
DNS Vulnerability Check:
 GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Thanks again for the help

Dan