Nexplore, Stopzilla, Registry Defender popups, Google search results redirected

Comments

• Trogan London, UK

  May 2009 edited May 2009

  Hi,
  
  Please do the following...
  
  1. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
  This program is for XP and Windows 2000 only!

  • Double-click ATF Cleaner.exe to open it.
  • Under Main select the following:
    
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Java Cache

  *The other boxes are optional*
  Then click the Empty Selected button.
  
  Click Exit on the Main menu to close the program.
  
  2. Please download Malwarebytes' Anti-Malware to your desktop.
  

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt

  
  3. I need to see another log from HijackThis.

  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.

  
  4. Please post the following...
  
  Uninstall list
  Malwarebytes log
  New HijackThis log

  0
• mdraughn

  May 2009 edited May 2009

  Thanks. I think I did what you wanted.
  
  Here are the results in the order you listed them:
  
  Uninstall list

  ---

  
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  2007 Microsoft Office Suite Service Pack 1 (SP1)
  32 Bit HP CIO Components Installer
  Acrobat.com
  Ad-Aware
  Ad-Aware
  Adobe AIR
  Adobe AIR
  Adobe Flash Player 10 ActiveX
  Adobe Flash Player 10 Plugin
  Adobe Media Player
  Adobe Reader 9.1
  Apple Software Update
  Araxis Merge
  ATI Display Driver
  CamStudio
  CDDRV_Installer
  Choice Guard
  Critical Update for Windows Media Player 11 (KB959772)
  Crystal Reports Basic for Visual Studio 2008
  CuteFTP 8 Professional
  getPlus(R) for Adobe
  Google Earth
  Google Toolbar for Internet Explorer
  Google Toolbar for Internet Explorer
  Google Update Helper
  Google Updater
  Hamachi 1.0.3.0
  HijackThis 2.0.2
  Horas
  Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
  Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
  Hotfix for Microsoft Visual Studio 2008 Professional Edition - ENU (KB952241)
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows Media Player 11 (KB939683)
  Hotfix for Windows XP (KB952287)
  Hotfix for Windows XP (KB961118)
  HP Customer Participation Program 10.0
  HP Document Manager 1.0
  HP Imaging Device Functions 10.0
  HP Officejet All-In-One Series
  HP Photosmart Essential 2.5
  HP Smart Web Printing
  HP Solution Center 10.0
  HP Update
  Java(TM) 6 Update 10
  KhalInstallWrapper
  Linksys Wireless Manager
  Logitech QuickCam
  Logitech QuickCam Driver Package
  Logitech SetPoint
  LogMeIn
  Malwarebytes' Anti-Malware
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft .NET Framework 2.0 Service Pack 2
  Microsoft .NET Framework 3.0 Service Pack 2
  Microsoft .NET Framework 3.5 SP1
  Microsoft .NET Framework 3.5 SP1
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Device Emulator version 3.0 - ENU
  Microsoft Document Explorer 2008
  Microsoft Document Explorer 2008
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
  Microsoft National Language Support Downlevel APIs
  Microsoft Office 2003 Web Components
  Microsoft Office Access MUI (English) 2007
  Microsoft Office Access Setup Metadata MUI (English) 2007
  Microsoft Office Enterprise 2007
  Microsoft Office Enterprise 2007
  Microsoft Office Excel MUI (English) 2007
  Microsoft Office Groove MUI (English) 2007
  Microsoft Office Groove Setup Metadata MUI (English) 2007
  Microsoft Office InfoPath MUI (English) 2007
  Microsoft Office OneNote MUI (English) 2007
  Microsoft Office Outlook MUI (English) 2007
  Microsoft Office PowerPoint MUI (English) 2007
  Microsoft Office Proof (English) 2007
  Microsoft Office Proof (French) 2007
  Microsoft Office Proof (Spanish) 2007
  Microsoft Office Proofing (English) 2007
  Microsoft Office Publisher MUI (English) 2007
  Microsoft Office Shared MUI (English) 2007
  Microsoft Office Shared Setup Metadata MUI (English) 2007
  Microsoft Office Visual Web Developer 2007
  Microsoft Office Visual Web Developer MUI (English) 2007
  Microsoft Office Word MUI (English) 2007
  Microsoft SQL Server 2005
  Microsoft SQL Server 2005
  Microsoft SQL Server 2005 Backward compatibility
  Microsoft SQL Server 2005 Books Online (English)
  Microsoft SQL Server 2005 Tools
  Microsoft SQL Server 2005 Upgrade Advisor (English)
  Microsoft SQL Server Compact 3.5 Design Tools ENU
  Microsoft SQL Server Compact 3.5 ENU
  Microsoft SQL Server Compact 3.5 for Devices ENU
  Microsoft SQL Server Database Publishing Wizard 1.2
  Microsoft SQL Server Native Client
  Microsoft SQL Server Setup Support Files (English)
  Microsoft SQL Server VSS Writer
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Visual C++ 2005 Redistributable
  Microsoft Visual Studio 2005 Premier Partner Edition - ENU
  Microsoft Visual Studio 2005 Tools for Office Runtime
  Microsoft Visual Studio 2008 Professional Edition - ENU
  Microsoft Visual Studio Web Authoring Component
  Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools
  Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
  Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
  Microsoft Windows SDK for Visual Studio 2008 Tools
  Microsoft Windows SDK for Visual Studio 2008 Win32 Tools
  Mozilla Firefox (3.0.10)
  MozyPro Remote Backup
  MSDN Library for Visual Studio 2008 - ENU
  MSDN Library for Visual Studio 2008 - ENU
  MSVCRT
  MSXML 4.0 SP2 (KB954430)
  MSXML 6.0 Parser
  OCR Software by I.R.I.S. 10.0
  PaperPort Image Printer
  QuickTime
  Rhapsody
  ScanSoft PaperPort 11
  ScanSoft PDF Create! 4
  Security Update for 2007 Microsoft Office System (KB951550)
  Security Update for 2007 Microsoft Office System (KB951550)
  Security Update for 2007 Microsoft Office System (KB951944)
  Security Update for 2007 Microsoft Office System (KB951944)
  Security Update for 2007 Microsoft Office System (KB960003)
  Security Update for Microsoft Office Excel 2007 (KB959997)
  Security Update for Microsoft Office OneNote 2007 (KB950130)
  Security Update for Microsoft Office PowerPoint 2007 (KB957789)
  Security Update for Microsoft Office Publisher 2007 (KB950114)
  Security Update for Microsoft Office system 2007 (KB954326)
  Security Update for Microsoft Office system 2007 (KB954326)
  Security Update for Microsoft Office system 2007 (KB956828)
  Security Update for Microsoft Office Word 2007 (KB956358)
  Security Update for Windows Internet Explorer 7 (KB938127-v2)
  Security Update for Windows Internet Explorer 7 (KB961260)
  Security Update for Windows Internet Explorer 7 (KB963027)
  Security Update for Windows Media Player (KB952069)
  Security Update for Windows Media Player 11 (KB936782)
  Security Update for Windows Media Player 11 (KB954154)
  Security Update for Windows XP (KB923561)
  Security Update for Windows XP (KB923789)
  Security Update for Windows XP (KB938464-v2)
  Security Update for Windows XP (KB941569)
  Security Update for Windows XP (KB946648)
  Security Update for Windows XP (KB950760)
  Security Update for Windows XP (KB950762)
  Security Update for Windows XP (KB950974)
  Security Update for Windows XP (KB951066)
  Security Update for Windows XP (KB951376-v2)
  Security Update for Windows XP (KB951698)
  Security Update for Windows XP (KB951748)
  Security Update for Windows XP (KB952004)
  Security Update for Windows XP (KB952954)
  Security Update for Windows XP (KB954459)
  Security Update for Windows XP (KB954600)
  Security Update for Windows XP (KB955069)
  Security Update for Windows XP (KB956572)
  Security Update for Windows XP (KB956802)
  Security Update for Windows XP (KB956803)
  Security Update for Windows XP (KB956841)
  Security Update for Windows XP (KB957097)
  Security Update for Windows XP (KB958215)
  Security Update for Windows XP (KB958644)
  Security Update for Windows XP (KB958687)
  Security Update for Windows XP (KB958690)
  Security Update for Windows XP (KB959426)
  Security Update for Windows XP (KB960225)
  Security Update for Windows XP (KB960714)
  Security Update for Windows XP (KB960715)
  Security Update for Windows XP (KB960803)
  Security Update for Windows XP (KB961373)
  Segoe UI
  Shop for HP Supplies
  Skypeâ„¢ 4.0
  SonicWALL SSL-VPN NetExtender
  Sony Vegas Pro 8.0
  SourceGear Vault Client
  Spybot - Search & Destroy
  SQLXML4
  TextPad 5
  TrueCrypt
  TweetDeck
  Update for 2007 Microsoft Office System (KB967642)
  Update for 2007 Microsoft Office System (KB967642)
  Update for Microsoft Office 2007 Help for Common Features (KB957244)
  Update for Microsoft Office Outlook 2007 (KB952142)
  Update for Microsoft Script Editor Help (KB957253)
  Update for Outlook 2007 Junk Email Filter (kb968503)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB951978)
  Update for Windows XP (KB955839)
  Update for Windows XP (KB961503)
  Update for Windows XP (KB967715)
  Visual C++ 2008 x86 Runtime - (v9.0.30729)
  Visual C++ 2008 x86 Runtime - v9.0.30729.01
  Visual Studio 2005 Tools for Office Second Edition Runtime
  Visual Studio Tools for the Office system 3.0 Runtime
  Visual Studio Tools for the Office system 3.0 Runtime
  VMware Workstation
  Windows Internet Explorer 7
  Windows Live Call
  Windows Live Communications Platform
  Windows Live Essentials
  Windows Live Essentials
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Live Upload Tool
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  Windows Mobile 5.0 SDK R2 for Pocket PC
  Windows Mobile 5.0 SDK R2 for Smartphone
  Windows XP Service Pack 3
  
  Malwarebytes log

  ---

  Malwarebytes' Anti-Malware 1.36
  Database version: 2145
  Windows 5.1.2600 Service Pack 3
  
  5/17/2009 11:33:54 AM
  mbam-log-2009-05-17 (11-33-54).txt
  
  Scan type: Full Scan (C:\|D:\|F:\|G:\|S:\|)
  Objects scanned: 649326
  Time elapsed: 2 hour(s), 3 minute(s), 44 second(s)
  
  Memory Processes Infected: 1
  Memory Modules Infected: 2
  Registry Keys Infected: 7
  Registry Values Infected: 11
  Registry Data Items Infected: 5
  Folders Infected: 1
  Files Infected: 9
  
  Memory Processes Infected:
  D:\Documents and Settings\Mark\Application Data\ptidle\ptidle.exe (Trojan.Downloader) -> Unloaded process successfully.
  
  Memory Modules Infected:
  D:\WINDOWS\system32\wowafuha.dll (Trojan.Vundo.H) -> Delete on reboot.
  d:\WINDOWS\system32\towoyila.dll (Trojan.Vundo.H) -> Delete on reboot.
  
  Registry Keys Infected:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{adfcec9b-fda7-46b6-8fb6-eded965bcaec} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{adfcec9b-fda7-46b6-8fb6-eded965bcaec} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Registry Values Infected:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\50df3dab (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm4f637195 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wokoliputu (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ptidle (Trojan.Downloader) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga6962 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc634 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga1547 (Trojan.TDSS) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1939 (Trojan.TDSS) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Registry Data Items Infected:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: d:\windows\system32\towoyila.dll -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
  
  Folders Infected:
  D:\Documents and Settings\Mark\Application Data\ptidle (Trojan.Downloader) -> Quarantined and deleted successfully.
  
  Files Infected:
  D:\WINDOWS\system32\wowafuha.dll (Trojan.Vundo.H) -> Delete on reboot.
  D:\WINDOWS\system32\ahufawow.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
  d:\WINDOWS\system32\towoyila.dll (Trojan.Vundo.H) -> Delete on reboot.
  D:\Documents and Settings\Mark\Application Data\ptidle\ptidle.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
  D:\WINDOWS\system32\japetosu.dll_old (Trojan.Vundo.H) -> Delete on reboot.
  D:\WINDOWS\system32\ovfsthpflovwbaswjjrtkxpxnwyeddahngecoo.dll_old (Trojan.TDSS) -> Delete on reboot.
  D:\Documents and Settings\Mark\Desktop\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
  D:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CH6B87SB\lsp[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
  D:\WINDOWS\system32\loader49.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
  
  New HijackThis log

  ---

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:54:57 AM, on 5/17/2009
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16827)
  Boot mode: Normal
  
  Running processes:
  D:\WINDOWS\System32\smss.exe
  D:\WINDOWS\system32\winlogon.exe
  D:\WINDOWS\system32\services.exe
  D:\WINDOWS\system32\lsass.exe
  D:\WINDOWS\system32\Ati2evxx.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
  D:\WINDOWS\system32\spoolsv.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\system32\svchost.exe
  D:\Program Files\Java\jre6\bin\jqs.exe
  D:\Program Files\LogMeIn\x86\RaMaint.exe
  D:\WINDOWS\system32\Ati2evxx.exe
  D:\Program Files\Google\Update\GoogleUpdate.exe
  D:\WINDOWS\Explorer.EXE
  D:\Program Files\LogMeIn\x86\LogMeIn.exe
  D:\Program Files\LogMeIn\x86\LMIGuardian.exe
  D:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
  D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
  D:\Program Files\MozyPro\mozyprobackup.exe
  D:\WINDOWS\System32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\system32\vmnat.exe
  D:\WINDOWS\system32\vmnetdhcp.exe
  D:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
  D:\Program Files\VMware\VMware Workstation\vmware-authd.exe
  D:\Program Files\VMware\VMware Workstation\vmware-tray.exe
  D:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
  D:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
  D:\Program Files\LogMeIn\x86\LogMeInSystray.exe
  D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
  D:\Program Files\Google\Quick Search Box\qsb.exe
  D:\Program Files\Microsoft IntelliPoint\ipoint.exe
  D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  D:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
  D:\Program Files\LogMeIn\x86\LMIGuardian.exe
  D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
  D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  D:\Program Files\Windows Live\Messenger\msnmsgr.exe
  D:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
  D:\WINDOWS\system32\ctfmon.exe
  D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  D:\Program Files\Logitech\SetPoint\SetPoint.exe
  D:\Program Files\MozyPro\mozyprostat.exe
  D:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
  D:\WINDOWS\system32\wscntfy.exe
  D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  D:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
  D:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
  D:\Program Files\Mozilla Firefox\firefox.exe
  D:\WINDOWS\system32\notepad.exe
  D:\Program Files\trend micro\HijackThis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
  O1 - Hosts: 69.17.24.168 dsoftco-wkstn1
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - D:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
  O2 - BHO: (no name) - {adfcec9b-fda7-46b6-8fb6-eded965bcaec} - (no file)
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
  O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - D:\Program Files\Google\Google Toolbar\Component\fastsearch_9993303B90FE6C1D.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - D:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
  O4 - HKLM\..\Run: [vmware-tray] "D:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
  O4 - HKLM\..\Run: [nmctxth] "D:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
  O4 - HKLM\..\Run: [Linksys Wireless Manager] "D:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
  O4 - HKLM\..\Run: [LogMeIn GUI] "D:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
  O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
  O4 - HKLM\..\Run: [Google Quick Search Box] "D:\Program Files\Google\Quick Search Box\qsb.exe" /autorun
  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  O4 - HKLM\..\Run: [SonicWALLNetExtender] D:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEGui.exe -hideGUI -clearReboot
  O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "D:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
  O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\ipoint.exe"
  O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [hpqSRMon] D:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
  O4 - HKLM\..\Run: [SSBkgdUpdate] "D:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
  O4 - HKLM\..\Run: [PaperPort PTD] "D:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
  O4 - HKLM\..\Run: [IndexSearch] "D:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
  O4 - HKLM\..\Run: [PPort11reminder] "D:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "D:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
  O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
  O4 - HKLM\..\Run: [CPM4f637195] Rundll32.exe "d:\windows\system32\towoyila.dll",a
  O4 - HKLM\..\Run: [50df3dab] rundll32.exe "D:\WINDOWS\system32\wowafuha.dll",b
  O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [net] "D:\WINDOWS\system32\net.net"
  O4 - HKCU\..\Run: [ptidle] "D:\Documents and Settings\Mark\Application Data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
  O4 - Startup: Horas.lnk = D:\Program Files\Basta Computing\Horas\Horas.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
  O4 - Global Startup: MozyPro Status.lnk = D:\Program Files\MozyPro\mozyprostat.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
  O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
  O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - D:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: d:\program files\vmware\vmware workstation\vsocklib.dll
  O10 - Unknown file in Winsock LSP: d:\program files\vmware\vmware workstation\vsocklib.dll
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237842809828
  O16 - DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} (NELaunchCtrl Class) - https://remote.mybenefitexpress.com/NELX.cab
  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
  O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
  O17 - HKLM\System\CCS\Services\Tcpip\..\{D6FD7FB4-E819-46CE-9BC7-952ABAA654F5}: Domain = hsd1.il.comcast.net.
  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - D:\Program Files\Google\Google Toolbar\Component\fastsearch_9993303B90FE6C1D.dll
  O20 - AppInit_DLLs: d:\windows\system32\ d:\windows\system32\japetosu.dll D:\WINDOWS\system32\ D:\WINDOWS\system32\selinova.dll
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - D:\Program Files\NOS\bin\getPlus_HelperSvc.exe
  O23 - Service: Google Update Service (gupdate1c9ae15ebd5409c) (gupdate1c9ae15ebd5409c) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
  O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
  O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - D:\Program Files\LogMeIn\x86\RaMaint.exe
  O23 - Service: LogMeIn - LogMeIn, Inc. - D:\Program Files\LogMeIn\x86\LogMeIn.exe
  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - D:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
  O23 - Service: MozyPro Backup Service (mozyprobackup) - Mozy, Inc. - D:\Program Files\MozyPro\mozyprobackup.exe
  O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - D:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
  O23 - Service: SonicWALL NetExtender Service (SONICWALL_NetExtender) - SonicWALL Inc. - D:\Program Files\SonicWALL\SSL-VPN\NetExtender\NEService.exe
  O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - D:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
  O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\Program Files\VMware\VMware Workstation\vmware-authd.exe
  O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - D:\WINDOWS\system32\vmnetdhcp.exe
  O23 - Service: VMware NAT Service - VMware, Inc. - D:\WINDOWS\system32\vmnat.exe
  
  --
  End of file - 13706 bytes

  0
• mdraughn

  May 2009 edited May 2009

  FYI, out of curiousity, I re-ran MalwareBytes' Anti-Malware (but I did not have it remove anything without hearing from you first) and it still shows a few problems:
  
  Malwarebytes' Anti-Malware 1.36
  Database version: 2145
  Windows 5.1.2600 Service Pack 3
  
  5/17/2009 8:56:08 PM
  mbam-log-2009-05-17 (20-56-01).txt
  
  Scan type: Full Scan (C:\|D:\|)
  Objects scanned: 184853
  Time elapsed: 25 minute(s), 45 second(s)
  
  Memory Processes Infected: 0
  Memory Modules Infected: 1
  Registry Keys Infected: 0
  Registry Values Infected: 2
  Registry Data Items Infected: 0
  Folders Infected: 0
  Files Infected: 8
  
  Memory Processes Infected:
  (No malicious items detected)
  
  Memory Modules Infected:
  D:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> No action taken.
  
  Registry Keys Infected:
  (No malicious items detected)
  
  Registry Values Infected:
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ptidle (Trojan.Downloader) -> No action taken.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net (Trojan.Agent) -> No action taken.
  
  Registry Data Items Infected:
  (No malicious items detected)
  
  Folders Infected:
  (No malicious items detected)
  
  Files Infected:
  D:\Documents and Settings\Mark\protect.dll (Trojan.Agent) -> No action taken.
  D:\Documents and Settings\Mark\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> No action taken.
  D:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> No action taken.
  D:\Documents and Settings\Mark\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> No action taken.
  D:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> No action taken.
  D:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> No action taken.
  D:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> No action taken.
  D:\WINDOWS\system32\lmn_setup.exe (Trojan.Downloader) -> No action taken.

  0
• Trogan London, UK

  May 2009 edited May 2009

  Hi,
  
  Yes, you can remove the findings with Malwarebytes. Save the log and post it here.
  
  In the meantime, please do the following...
  
  1. Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:
  
  Java(TM) 6 Update 10
  
  2. Now download and install Java SE Runtime Environment (JRE) 6 Update 13.
  
  3. Please download GooredFix from one of the locations below and save it to your Desktop
  Download Mirror #1
  Download Mirror #2
  

  • Double-click GooredFix.exe to run it.
  • Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
  • A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

  Note: Do not run Option #2 yet.
  
  3. Please post the following...
  
  Malwarebytes
  GooredFix

  0