Home Antivirus 2010

Tried installing Malwarebytes, that went successful, until it started to run, then evidently the virus/malware shut it down. It's hijacked my IE browser and frankly I'm quite suprised it didn't redirect me from here. Anyway I've read a few posts about HJT but thought I'd await further instruction before I did anything further. Thanks in advance.

Went ahead and looked thru the forums thought I'd get the HJT report ready for you, downloaded from a link on these boards did the install, but when I click on the shortcut it created nothing happens so this mal/virus has it blocked as well

*Bump*

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
scecli.dll
netlogon.dll
eventlog.dll

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 08:56 on 30/08/2009 by Compaq_Owner (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\WINDOWS\system32\dllcache\scecli.dll --a--c 180224 bytes [05:33 02/08/2005] [05:00 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\system32\scecli.dll --a--- 60928 bytes [05:33 02/08/2005] [05:00 04/08/2004] (Unable to calculate MD5)

Searching for "netlogon.dll"
C:\WINDOWS\system32\dllcache\netlogon.dll --a--- 407040 bytes [05:32 02/08/2005] [05:00 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\system32\netlogon.dll --a--- 407040 bytes [05:32 02/08/2005] [05:00 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A

Searching for "eventlog.dll"
C:\WINDOWS\system32\dllcache\eventlog.dll --a--c 55808 bytes [05:30 02/08/2005] [05:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\system32\eventlog.dll --a--- 55808 bytes [05:30 02/08/2005] [05:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78

-=End Of File=-

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\scecli.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\scecli.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Hello.
Delete the Hijack This you have now and re-download it, it will run fine now.

Post a log when done.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:47:13 PM, on 8/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\winlogon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.marktwain.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://marktwain.net/search.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Mark Twain Rural Telephone Co.
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [gupegonami] Rundll32.exe "C:\WINDOWS\system32\tesavohi.dll",s (User 'LOCAL SERVICE')
O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.marktwain.net
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{50C7CC92-25C9-430E-AEA6-3A4099D151CF}: NameServer = 216.163.120.19,216.163.120.21
O20 - AppInit_DLLs: cru629.dat
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tizohafi.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tizohafi.dll (file missing)
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\system32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O24 - Desktop Component 0: (no name) - file:///C:/Program%20Files/Internet%20Explorer/SIGNUP/mtrtc.bmp

--
End of file - 5172 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  O4 - HKLM\..\Run: [braviax] braviax.exe
  O4 - HKUS\S-1-5-19\..\Run: [gupegonami] Rundll32.exe "C:\WINDOWS\system32\tesavohi.dll",s (User 'LOCAL SERVICE')
  O20 - AppInit_DLLs: cru629.dat
  O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tizohafi.dll (file missing)
  O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tizohafi.dll (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.40
Database version: 2719
Windows 5.1.2600 Service Pack 2

8/30/2009 4:45:24 PM
mbam-log-2009-08-30 (16-45-16).txt

Scan type: Quick Scan
Objects scanned: 119577
Time elapsed: 18 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 6
Registry Data Items Infected: 6
Folders Infected: 7
Files Infected: 105

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet AntiVirus Pro_is1 (Rogue.InternetAntiVirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wind Optimizer_is1 (Rogue.WindOptimizer) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\braviax (Trojan.Downloader) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\db (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Wind Optimizer (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Wind Optimizer\db (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\db (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Wind Optimizer (Rogue.WindOptimizer) -> No action taken.

Files Infected:
C:\WINDOWS\system32\braviax.exe (Trojan.FakeAlert) -> No action taken.
C:\Program Files\Common Files\file.exe (Rogue.Agent) -> No action taken.
C:\Program Files\Common Files\InternetAntivirusPro.exe (Rogue.InternetAntiVirus) -> No action taken.
C:\hcel.exe (Trojan.Dropper) -> No action taken.
C:\niawndos.exe (Trojan.Dropper) -> No action taken.
C:\rcvbm.exe (Trojan.Dropper) -> No action taken.
C:\umoikchf.exe (Trojan.Dropper) -> No action taken.
C:\yedfjdy.exe (Trojan.TDSS) -> No action taken.
C:\WINDOWS\system32\cru629.dat (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\wisdstr.exe (Rogue.Installer) -> No action taken.
C:\WINDOWS\system32\_scui.cpl (Rogue.HomeAntiVirus) -> No action taken.
C:\WINDOWS\system32\drivers\beep.sys (Trojan.KillAV) -> No action taken.
C:\WINDOWS\system32\wbem\proquota.exe (Trojan.PWS) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\msupd_2.exe (Rogue.Installer) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\11.tmp (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\1A.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\odins_1249367092.exe (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\~TM17.tmp (Trojan.PWS) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\7Z0ABUV5\dnxuh[1].htm (Trojan.TDSS) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\7Z0ABUV5\bdarsj[1].htm (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\CY5RMEF7\prx[1].exe (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\CY5RMEF7\yisfwkx[1].htm (Trojan.TDSS) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\CY5RMEF7\yrnwkxyppq[1].txt (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\OY89S2C4\foypq[1].htm (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\P0WR0U87\bxuii[1].htm (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\Temporary Internet Files\Content.IE5\P0WR0U87\utt[1].php (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\8TIZCXIZ\install[1].exe (Rogue.InternetAntivirus) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\8TIZCXIZ\install[2].exe (Rogue.InternetAntivirus) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\8TIZCXIZ\ms.21[1].exe (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\CHEBCTI7\install[1].exe (Rogue.InternetAntivirus) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\SLIB4DMB\fb.58[1].exe (Worm.Koobface) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\WOVB3G5I\install[1].exe (Rogue.Agent) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\WOVB3G5I\install[2].exe (Rogue.Agent) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temporary Internet Files\Content.IE5\XJQ0MK64\install[1].exe (Rogue.Agent) -> No action taken.
C:\WINDOWS\freddy55.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\freddy58.exe (Worm.Koobface) -> No action taken.
C:\WINDOWS\pp10.exe (Worm.Koobface) -> No action taken.
C:\WINDOWS\pp11.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\braviax.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\mstre19.exe (Worm.Koobface) -> No action taken.
C:\WINDOWS\cru629.dat (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\odinpix1249353278.eXe (Spyware.LdPinch) -> No action taken.
C:\WINDOWS\ld12.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\HTFRWindOptimizerTaskFile.exe (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\settings.ini (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\uill.ini (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\unins000.exe (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\Uninstall Internet Antivirus Pro.lnk (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\updateloadlist.ini (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\db\config.cfg (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\db\Timeout.inf (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Internet Antivirus Pro\db\Urls.inf (Rogue.InternetAntiVirus) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Wind Optimizer\updateloadlist.ini (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Wind Optimizer\db\Settings.ini (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Wind Optimizer\db\Urls.inf (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\activate.ico (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\Explorer.ico (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\log_05082009.wlg (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\unins000.dat (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\unins000.exe (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\uninstall.ico (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\vista.manifest (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\vista.res (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\WindOptimizer.exe (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\WODefragmenter.exe (Rogue.WindOptimizer) -> No action taken.
C:\Program Files\Wind Optimizer\WOIsnce.db (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Wind Optimizer\Purchase License.lnk (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Wind Optimizer\Uninstall Wind Optimizer.lnk (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Wind Optimizer\Wind Optimizer Home Page.lnk (Rogue.WindOptimizer) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Wind Optimizer\Wind Optimizer.lnk (Rogue.WindOptimizer) -> No action taken.
C:\WINDOWS\mmsmark2.dat (KoobFace.Trace) -> No action taken.
C:\WINDOWS\th823567.dat (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\All Users\Application Data\mevimevy.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Taylor\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Antivirus Pro.lnk (Rogue.InternetAntiVirus) -> No action taken.
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.sys) -> No action taken.
C:\WINDOWS\system32\dllcache\figaro.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\merunime.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\roboketu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\rusejafe.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\serevudo.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\tesavohi.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wupudihi.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\zodofigu.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\785.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Application Data\Microsoft\Windows\pguard.ini (Rogue.InternetAntiVirus) -> No action taken.
C:\WINDOWS\010112010146120114.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\0101120101464849.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\0101120101464949.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\0101120101465353.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\0101120101465449.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\0101120101465749.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\934fdfg34fgjf23 (Worm.KoobFace) -> No action taken.
C:\WINDOWS\freddy56.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\jmmark2.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\prxid93ps.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr2 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr3 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr4 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr5 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr6 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr7 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr8 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr9 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\tmpwr2 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\tmpwr3 (Rogue.Install) -> No action taken.

C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr4 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr5 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr6 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr7 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr8 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\tmpwr9 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\tmpwr2 (Rogue.Install) -> No action taken.
C:\Documents and Settings\Taylor\Local Settings\Temp\tmpwr3 (Rogue.Install) -> No action taken.

I hope I haven't upset you and your help has been fantastic, while waiting on your last reply I went ahead and downloaded the MBM again and ran it, that log is from that particular run. I've gone ahead now and did what you told me to do with the HJT and took out the files instructed I realize I should have waited but I know how busy you folks are. Do you want me to run the MBM again.? Once again I'm sorry I jumped the gun and Thank You in advance.

Hello.
No problem, just one small thing. MBAM says "No action taken.", did you take the log BEFORE removing everything it found?

Yes I saved the log, then fixed selected and I accidently posted the first log and not the second. Seems to be running ok again should I go further?

Yes.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt just yet.
  

DDS (Ver_09-07-30.01) - NTFSx86
Run by Compaq_Owner at 16:50:23.90 on Mon 08/31/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222.52 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser
uWindow Title = Microsoft Internet Explorer provided by Mark Twain Rural Telephone Co.
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.marktwain.net
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://marktwain.net/search.php
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
TB: {5BED3930-2E9E-76D8-BACC-80DF2188D455} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
IE: Add To Compaq Organize... - c:\progra~1\hewlet~1\compaq~1\bin/module.main/favorites\ie_add_to.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0\bin\npjpi150.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {50C7CC92-25C9-430E-AEA6-3A4099D151CF} = 216.163.120.19,216.163.120.21
Notify: AtiExtEvent - Ati2evxx.dll
LSA: Notification Packages = scecli c:\windows\system32\bikusono.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\eq1a1jxg.default\
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\program files\java\jre1.5.0\bin\NPOJI610.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]

=============== Created Last 30 ================

2009-08-30 08:54 --d----- c:\windows\system32\CatRoot_bak
2009-08-28 18:26 18,867 a------- c:\docume~1\compaq~1\applic~1\eniq.scr
2009-08-28 18:26 18,865 a------- c:\program files\common files\atek.exe
2009-08-28 18:26 18,691 a------- c:\program files\common files\upinuxubogy.vbs
2009-08-28 18:26 17,987 a------- c:\program files\common files\lejuz.com
2009-08-28 18:26 17,831 a------- c:\program files\common files\ycag.reg
2009-08-28 18:26 17,787 a------- c:\windows\tigiv.vbs
2009-08-28 18:26 17,491 a------- c:\windows\qiroku.reg
2009-08-28 18:26 17,468 a------- c:\windows\focoxotaxo.com
2009-08-28 18:26 17,378 a------- c:\windows\ypykupyna.bat
2009-08-28 18:26 15,576 a------- c:\program files\common files\neme.com
2009-08-28 18:26 14,182 a------- c:\docume~1\compaq~1\applic~1\odefuje.bin
2009-08-28 18:26 13,218 a------- c:\program files\common files\yvypyk.dat
2009-08-28 18:26 12,628 a------- c:\windows\uryp.com
2009-08-28 18:26 10,622 a------- c:\windows\unuvihevyf.inf
2009-08-28 18:26 10,113 a------- c:\windows\xegewopil.vbs
2009-08-28 18:18 11,383 a------- c:\windows\fywy.sys
2009-08-28 18:18 10,594 a------- c:\windows\system32\lupemadif.dat
2009-08-28 18:18 18,486 a------- c:\windows\cogajufy.vbs
2009-08-28 18:18 15,919 a------- c:\windows\system32\wenes.com
2009-08-28 18:18 14,083 a------- c:\program files\common files\ujujiwy.com
2009-08-28 18:18 11,014 a------- c:\program files\common files\yduvoropus.bin
2009-08-28 18:18 10,915 a------- c:\windows\otefegygif.bin
2009-08-28 18:18 10,572 a------- c:\docume~1\compaq~1\applic~1\ikafuga.pif
2009-08-28 18:18 18,827 a------- c:\windows\system32\emyqo.pif
2009-08-28 18:18 15,731 a------- c:\windows\izabyxy.dat
2009-08-28 18:18 13,666 a------- c:\docume~1\compaq~1\applic~1\lixak.pif
2009-08-28 18:18 12,877 a------- c:\windows\system32\ananeqyz._dl
2009-08-28 18:18 12,592 a------- c:\windows\komofos.bat
2009-08-28 18:18 10,571 a------- c:\docume~1\alluse~1\applic~1\izesilob.sys
2009-08-28 18:12 19,854 a------- c:\docume~1\compaq~1\applic~1\ilamot.bat
2009-08-28 18:12 19,518 a------- c:\windows\eqil.dll
2009-08-28 18:12 18,885 a------- c:\windows\yfofixim.ban
2009-08-28 18:12 18,000 a------- c:\windows\yzovuqymyz.exe
2009-08-28 18:12 16,554 a------- c:\windows\system32\ranoz._dl
2009-08-28 18:12 16,292 a------- c:\windows\system32\ecajyfalak.scr
2009-08-28 18:12 14,655 a------- c:\windows\edijahebe.ban
2009-08-28 18:12 12,062 a------- c:\windows\system32\esukabihu.inf
2009-08-28 18:12 17,157 a------- c:\program files\common files\cefi.scr
2009-08-28 18:12 16,442 a------- c:\docume~1\compaq~1\applic~1\wisut.sys
2009-08-28 18:12 12,526 a------- c:\docume~1\compaq~1\applic~1\yjafi.bat
2009-08-28 18:12 11,649 a------- c:\windows\system32\zurew.exe
2009-08-27 17:17 --d----- c:\docume~1\compaq~1\applic~1\GetRightToGo
2009-08-26 19:45 18,251 a------- c:\windows\system32\erafuvyny.dl
2009-08-26 19:45 17,101 a------- c:\docume~1\alluse~1\applic~1\iser.reg
2009-08-26 19:45 15,706 a------- c:\docume~1\compaq~1\applic~1\imuby.bat
2009-08-26 19:45 15,410 a------- c:\windows\system32\tasi.db
2009-08-26 19:45 15,356 a------- c:\windows\fumihyqa.lib
2009-08-26 19:45 14,596 a------- c:\windows\hybisef.lib
2009-08-26 19:45 12,113 a------- c:\windows\gedi.pif
2009-08-26 19:45 11,867 a------- c:\program files\common files\awyxyj.reg
2009-08-26 19:45 10,730 a------- c:\windows\system32\udyt.scr
2009-08-26 19:45 10,571 a------- c:\windows\farygojiq.vbs
2009-08-26 19:45 10,410 a------- c:\windows\ibirar.dl
2009-08-26 18:10 --d----- c:\windows\system32\LogFiles
2009-08-26 17:56 --d----- c:\program files\Trend Micro
2009-08-25 19:48 --d----- c:\windows\pss
2009-08-25 19:07 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-25 19:07 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-25 19:07 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-25 18:17 --d----- c:\program files\MSXML 4.0
2009-08-25 18:07 2,136,064 -------- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-08-25 18:07 2,180,480 -------- c:\windows\system32\dllcache\ntoskrnl.exe
2009-08-25 18:07 2,015,744 -------- c:\windows\system32\dllcache\ntkrpamp.exe
2009-08-25 18:07 2,057,728 -------- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-08-25 18:04 --d----- c:\docume~1\compaq~1\applic~1\Malwarebytes
2009-08-25 18:03 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-25 17:59 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys
2009-08-25 17:36 21,504 a------- c:\windows\system32\hidserv.dll
2009-08-25 17:36 21,504 a------- c:\windows\system32\dllcache\hidserv.dll
2009-08-25 17:36 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-08-25 17:36 12,160 a------- c:\windows\system32\dllcache\mouhid.sys
2009-08-25 17:35 9,600 a------- c:\windows\system32\drivers\hidusb.sys
2009-08-25 17:35 9,600 a------- c:\windows\system32\dllcache\hidusb.sys
2009-08-18 18:55 19,380 a------- c:\docume~1\compaq~1\applic~1\laxobe.pif
2009-08-18 18:55 18,875 a------- c:\program files\common files\durywusi.dll
2009-08-18 18:55 18,521 a------- c:\windows\uwof.scr
2009-08-18 18:55 17,579 a------- c:\windows\system32\itiz.lib
2009-08-18 18:55 17,341 a------- c:\program files\common files\kihuvoqihu.dll
2009-08-18 18:55 16,629 a------- c:\windows\jewomamici.vbs
2009-08-18 18:55 13,867 a------- c:\program files\common files\valogyguj.bat
2009-08-18 18:55 13,450 a------- c:\windows\lebek._dl
2009-08-18 18:55 13,020 a------- c:\docume~1\compaq~1\applic~1\xajapozo.scr
2009-08-18 18:55 12,347 a------- c:\windows\obudahuno.scr
2009-08-18 18:55 12,215 a------- c:\program files\common files\ativ.dat
2009-08-18 18:55 11,919 a------- c:\windows\uwynibe.ban
2009-08-18 18:55 11,521 a------- c:\program files\common files\nozanut.exe
2009-08-18 18:55 11,422 a------- c:\windows\cubun._sy
2009-08-18 18:50 272,128 -------- c:\windows\system32\drivers\bthport.sys
2009-08-18 18:50 272,128 -------- c:\windows\system32\dllcache\bthport.sys
2009-08-18 09:12 --d----- c:\windows\system32\PreInstall
2009-08-18 07:29 1 ----h--- c:\windows\ex23567.dat
2009-08-17 18:34 --d----- c:\windows\Profiles
2009-08-17 14:59 --d----- c:\windows\system32\SoftwareDistribution
2009-08-13 14:05 1 a------- c:\windows\4ff345dfbh521
2009-08-05 21:01 --d----- c:\windows\system32\CatRoot
2009-08-05 19:49 12,699 a------- c:\windows\ybogyni.dl
2009-08-05 19:49 12,928 a------- c:\windows\imajiraba.dat
2009-08-05 19:34 --d----- c:\windows\system32\CatRoot(2)
2009-08-03 21:39 1 a------- c:\windows\ckms134.dat
2009-08-03 21:34 2 a------- c:\windows\0535251103110107106.xsb

==================== Find3M ====================

2009-08-28 18:12 15,241 a------- c:\program files\common files\obuh.dl
2009-08-28 18:12 13,809 a------- c:\program files\common files\wekyqu.lib
2009-08-28 18:12 18,914 a------- c:\program files\common files\gyvefi.inf
2009-08-28 18:12 15,676 a------- c:\program files\common files\fefi._dl
2009-08-26 19:45 17,414 a------- c:\program files\common files\ojezocypa.lib
2009-08-26 19:45 14,579 a------- c:\program files\common files\jibawe.lib
2009-08-18 18:55 19,969 a------- c:\program files\common files\zogoni.dl
2009-08-18 18:55 19,619 a------- c:\program files\common files\ufoxi._sy
2009-08-05 19:49 17,481 a------- c:\program files\common files\yxuz._sy
2009-08-05 19:34 85,504 a--sh--- c:\windows\system32\tizohafi(2).dll
2009-08-05 04:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 04:11 204,800 a------- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 13:36 84,992 a--sh--- c:\windows\system32\kihugali.dll
2009-08-03 10:35 38,400 a--sh--- c:\windows\system32\norobeta.dll
2009-08-02 21:17 38,400 a--sh--- c:\windows\system32\lelimafu.dll
2009-07-28 23:53 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-28 23:53 119,808 a------- c:\windows\system32\dllcache\t2embed.dll
2009-07-28 23:53 82,432 a------- c:\windows\system32\fontsub.dll
2009-07-28 23:53 82,432 a------- c:\windows\system32\dllcache\fontsub.dll
2009-07-18 11:20 3,062,272 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-18 11:20 1,506,304 a------- c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 13:55 58,880 a------- c:\windows\system32\dllcache\atl.dll
2009-07-17 13:55 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 10:08 286,720 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 10:08 286,720 a------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-13 10:08 5,537,792 a------- c:\windows\system32\dllcache\wmp.dll
2009-07-10 08:42 1,315,328 a------- c:\windows\system32\dllcache\msoe.dll
2009-06-22 06:38 18,432 a------- c:\windows\system32\dllcache\iedw.exe
2009-06-12 06:50 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 06:50 76,288 a------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 09:21 84,992 a------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:21 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 01:32 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 01:32 132,096 a------- c:\windows\system32\dllcache\wkssvc.dll
2009-06-05 02:42 655,872 a------- c:\windows\system32\mstscax.dll
2009-06-05 02:42 655,872 a------- c:\windows\system32\dllcache\mstscax.dll
2009-06-03 14:27 1,290,752 a------- c:\windows\system32\quartz.dll
2009-06-03 14:27 1,290,752 a------- c:\windows\system32\dllcache\quartz.dll
2009-05-10 13:40 308,160 ac------ c:\program files\avast_home_setup.exe
2006-04-01 14:05 22 ac-sh--- c:\windows\sminst\HPCD.sys
2009-05-05 19:34 49,152 a--sh--- c:\windows\system32\bikusono(2).dll

============= FINISH: 16:51:31.48 ===============

Hello.

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\docume~1\compaq~1\applic~1\eniq.scr
  c:\program files\common files\atek.exe
  c:\program files\common files\upinuxubogy.vbs
  c:\program files\common files\lejuz.com
  c:\program files\common files\ycag.reg
  c:\windows\tigiv.vbs
  c:\windows\qiroku.reg
  c:\windows\focoxotaxo.com
  c:\windows\ypykupyna.bat
  c:\program files\common files\neme.com
  c:\docume~1\compaq~1\applic~1\odefuje.bin
  c:\program files\common files\yvypyk.dat
  c:\windows\uryp.com
  c:\windows\unuvihevyf.inf
  c:\windows\xegewopil.vbs
  c:\windows\fywy.sys
  c:\windows\system32\lupemadif.dat
  c:\windows\cogajufy.vbs
  c:\windows\system32\wenes.com
  c:\program files\common files\ujujiwy.com
  c:\program files\common files\yduvoropus.bin
  c:\windows\otefegygif.bin
  c:\docume~1\compaq~1\applic~1\ikafuga.pif
  c:\windows\system32\emyqo.pif
  c:\windows\izabyxy.dat
  c:\docume~1\compaq~1\applic~1\lixak.pif
  c:\windows\system32\ananeqyz._dl
  c:\windows\komofos.bat
  c:\docume~1\alluse~1\applic~1\izesilob.sys
  c:\docume~1\compaq~1\applic~1\ilamot.bat
  c:\windows\eqil.dll
  c:\windows\yfofixim.ban
  c:\windows\yzovuqymyz.exe
  c:\windows\system32\ranoz._dl
  c:\windows\system32\ecajyfalak.scr
  c:\windows\edijahebe.ban
  c:\windows\system32\esukabihu.inf
  c:\program files\common files\cefi.scr
  c:\docume~1\compaq~1\applic~1\wisut.sys
  c:\docume~1\compaq~1\applic~1\yjafi.bat
  c:\windows\system32\zurew.exe
  c:\windows\system32\erafuvyny.dl
  c:\docume~1\alluse~1\applic~1\iser.reg
  c:\docume~1\compaq~1\applic~1\imuby.bat
  c:\windows\system32\tasi.db
  c:\windows\fumihyqa.lib
  c:\windows\hybisef.lib
  c:\windows\gedi.pif
  c:\program files\common files\awyxyj.reg
  c:\windows\system32\udyt.scr
  c:\windows\farygojiq.vbs
  c:\windows\ibirar.dl
  :\docume~1\compaq~1\applic~1\laxobe.pif
  c:\program files\common files\durywusi.dll
  c:\windows\uwof.scr
  c:\windows\system32\itiz.lib
  c:\program files\common files\kihuvoqihu.dll
  c:\windows\jewomamici.vbs
  c:\program files\common files\valogyguj.bat
  c:\windows\lebek._dl
  c:\docume~1\compaq~1\applic~1\xajapozo.scr
  c:\windows\obudahuno.scr
  c:\program files\common files\ativ.dat
  c:\windows\uwynibe.ban
  c:\program files\common files\nozanut.exe
  c:\windows\cubun._sy
  c:\windows\ex23567.dat
  c:\windows\4ff345dfbh521
  c:\windows\ybogyni.dl
  c:\windows\imajiraba.dat
  c:\windows\ckms134.dat
  c:\windows\0535251103110107106.xsb
  c:\program files\common files\obuh.dl
  c:\program files\common files\wekyqu.lib
  c:\program files\common files\gyvefi.inf
  c:\program files\common files\fefi._dl
  c:\program files\common files\ojezocypa.lib
  c:\program files\common files\jibawe.lib
  c:\program files\common files\zogoni.dl
  c:\program files\common files\ufoxi._sy
  c:\program files\common files\yxuz._sy
  c:\windows\system32\tizohafi(2).dll
  c:\windows\system32\mswebdvd.dll
  c:\windows\system32\dllcache\mswebdvd.dll
  c:\windows\system32\kihugali.dll
  c:\windows\system32\norobeta.dll
  c:\windows\system32\lelimafu.dll
  c:\windows\system32\bikusono(2).dll
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
c:\docume~1\compaq~1\applic~1\eniq.scr moved successfully.
c:\program files\common files\atek.exe moved successfully.
c:\program files\common files\upinuxubogy.vbs moved successfully.
c:\program files\common files\lejuz.com moved successfully.
c:\program files\common files\ycag.reg moved successfully.
c:\windows\tigiv.vbs moved successfully.
c:\windows\qiroku.reg moved successfully.
c:\windows\focoxotaxo.com moved successfully.
c:\windows\ypykupyna.bat moved successfully.
c:\program files\common files\neme.com moved successfully.
c:\docume~1\compaq~1\applic~1\odefuje.bin moved successfully.
c:\program files\common files\yvypyk.dat moved successfully.
c:\windows\uryp.com moved successfully.
c:\windows\unuvihevyf.inf moved successfully.
c:\windows\xegewopil.vbs moved successfully.
c:\windows\fywy.sys moved successfully.
c:\windows\system32\lupemadif.dat moved successfully.
c:\windows\cogajufy.vbs moved successfully.
c:\windows\system32\wenes.com moved successfully.
c:\program files\common files\ujujiwy.com moved successfully.
c:\program files\common files\yduvoropus.bin moved successfully.
c:\windows\otefegygif.bin moved successfully.
c:\docume~1\compaq~1\applic~1\ikafuga.pif moved successfully.
c:\windows\system32\emyqo.pif moved successfully.
c:\windows\izabyxy.dat moved successfully.
c:\docume~1\compaq~1\applic~1\lixak.pif moved successfully.
c:\windows\system32\ananeqyz._dl moved successfully.
c:\windows\komofos.bat moved successfully.
c:\docume~1\alluse~1\applic~1\izesilob.sys moved successfully.
c:\docume~1\compaq~1\applic~1\ilamot.bat moved successfully.
LoadLibrary failed for c:\windows\eqil.dll
c:\windows\eqil.dll NOT unregistered.
c:\windows\eqil.dll moved successfully.
c:\windows\yfofixim.ban moved successfully.
c:\windows\yzovuqymyz.exe moved successfully.
c:\windows\system32\ranoz._dl moved successfully.
c:\windows\system32\ecajyfalak.scr moved successfully.
c:\windows\edijahebe.ban moved successfully.
c:\windows\system32\esukabihu.inf moved successfully.
c:\program files\common files\cefi.scr moved successfully.
c:\docume~1\compaq~1\applic~1\wisut.sys moved successfully.
c:\docume~1\compaq~1\applic~1\yjafi.bat moved successfully.
c:\windows\system32\zurew.exe moved successfully.
c:\windows\system32\erafuvyny.dl moved successfully.
c:\docume~1\alluse~1\applic~1\iser.reg moved successfully.
c:\docume~1\compaq~1\applic~1\imuby.bat moved successfully.
c:\windows\system32\tasi.db moved successfully.
c:\windows\fumihyqa.lib moved successfully.
c:\windows\hybisef.lib moved successfully.
c:\windows\gedi.pif moved successfully.
c:\program files\common files\awyxyj.reg moved successfully.
c:\windows\system32\udyt.scr moved successfully.
c:\windows\farygojiq.vbs moved successfully.
c:\windows\ibirar.dl moved successfully.
Error: Unable to interpret <:\docume~1\compaq~1\applic~1\laxobe.pif> in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!

OTM by OldTimer - Version 3.0.0.6 log created on 09012009_202018

[strike]

Last edited by rdb1962 on 2nd September 2009, 1:45 am; edited 1 time in total (Reason for editing : double post)

Hello?

Hello.
We need to run OTM again cause I made a mistake.

• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  Hello.
  
  
  C:\docume~1\compaq~1\applic~1\laxobe.pif
  c:\program files\common files\durywusi.dll
  c:\windows\uwof.scr
  c:\windows\system32\itiz.lib
  c:\program files\common files\kihuvoqihu.dll
  c:\windows\jewomamici.vbs
  c:\program files\common files\valogyguj.bat
  c:\windows\lebek._dl
  c:\docume~1\compaq~1\applic~1\xajapozo.scr
  c:\windows\obudahuno.scr
  c:\program files\common files\ativ.dat
  c:\windows\uwynibe.ban
  c:\program files\common files\nozanut.exe
  c:\windows\cubun._sy
  c:\windows\ex23567.dat
  c:\windows\4ff345dfbh521
  c:\windows\ybogyni.dl
  c:\windows\imajiraba.dat
  c:\windows\ckms134.dat
  c:\windows\0535251103110107106.xsb
  c:\program files\common files\obuh.dl
  c:\program files\common files\wekyqu.lib
  c:\program files\common files\gyvefi.inf
  c:\program files\common files\fefi._dl
  c:\program files\common files\ojezocypa.lib
  c:\program files\common files\jibawe.lib
  c:\program files\common files\zogoni.dl
  c:\program files\common files\ufoxi._sy
  c:\program files\common files\yxuz._sy
  c:\windows\system32\tizohafi(2).dll
  c:\windows\system32\mswebdvd.dll
  c:\windows\system32\dllcache\mswebdvd.dll
  c:\windows\system32\kihugali.dll
  c:\windows\system32\norobeta.dll
  c:\windows\system32\lelimafu.dll
  c:\windows\system32\bikusono(2).dll
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.