Topic: This is what I had to upload i guess ?

[Sehbahz]

Well yesterday, my computer had one of those trojan virus things. So i opened windows defender and did a full system scan and it recognized the trojan. It asked me what to do so i clicked "remove". So it either got removed or "quarantined". Now Internet Explorer won"t work. I click it; butit says it can't connect to eh internet. I do have internet connectivity though because america online opens up and it lets me log into aim, and windows live messenger. I don't what to do or what happened ?





DDS (Ver_09-12-01.01) - NTFSx86 
Run by Owner GX260 at 18:00:03.99 on Wed 12/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.499 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)   {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\AOL\1255456668\ee\aolsoftware.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Telmex\Telmex.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\Documents and Settings\Administrator\My Documents\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
uRun: [eyeBeam SIP Client] "c:\program files\telmex\Telmex.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US /HIDEBL
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
uRun: [gjtdhuci] c:\documents and settings\administrator\local settings\application data\warmbt\dymrsysguard.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [gjtdhuci] c:\documents and settings\administrator\local settings\application data\warmbt\dymrsysguard.exe
mRun: [HostManager] c:\program files\common files\aol\1255456668\ee\AOLSoftware.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221933485697
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
LSA: Notification Packages = scecli c:\windows\system32\zoheyayi.dll
Hosts: 127.0.0.1   www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-14 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-14 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-14 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-14 297752]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2009-8-11 20160]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-8-14 908056]

=============== Created Last 30 ================

2009-12-25 19:41:25   0   d-----w-   c:\documents and settings\administrator\Contacts
2009-12-25 19:40:43   268   ---ha-w-   C:\sqmdata07.sqm
2009-12-25 19:40:43   244   ---ha-w-   C:\sqmnoopt07.sqm
2009-12-22 21:52:23   268   ---ha-w-   C:\sqmdata06.sqm
2009-12-22 21:52:23   244   ---ha-w-   C:\sqmnoopt06.sqm
2009-12-22 02:13:02   1470   ------w-   c:\windows\hpomdl12.dat
2009-12-22 02:13:02   130953   ----a-w-   c:\windows\hpoins12.dat
2009-12-16 22:41:20   268   ---ha-w-   C:\sqmdata05.sqm
2009-12-16 22:41:20   244   ---ha-w-   C:\sqmnoopt05.sqm
2009-12-15 20:20:35   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-12-15 20:20:30   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-12-15 03:24:49   268   ---ha-w-   C:\sqmdata04.sqm
2009-12-15 03:24:49   244   ---ha-w-   C:\sqmnoopt04.sqm
2009-12-13 13:44:16   268   ---ha-w-   C:\sqmdata03.sqm
2009-12-13 13:44:16   244   ---ha-w-   C:\sqmnoopt03.sqm
2009-12-12 01:52:33   268   ---ha-w-   C:\sqmdata02.sqm
2009-12-12 01:52:33   244   ---ha-w-   C:\sqmnoopt02.sqm
2009-12-11 03:38:04   268   ---ha-w-   C:\sqmdata01.sqm
2009-12-11 03:38:04   244   ---ha-w-   C:\sqmnoopt01.sqm
2009-12-10 08:19:48   268   ---ha-w-   C:\sqmdata00.sqm
2009-12-10 08:19:48   244   ---ha-w-   C:\sqmnoopt00.sqm
2009-12-07 01:40:04   0   d-----w-   c:\docume~1\admini~1\applic~1\MozillaControl
2009-12-07 01:07:42   0   d-----w-   c:\program files\Mozilla ActiveX Control v1.7.12
2009-12-07 01:06:47   0   d-----w-   c:\program files\VideoLAN
2009-12-07 01:04:44   0   d-----w-   c:\program files\Graboid
2009-12-06 02:20:59   0   d-----w-   c:\program files\BluetoothWorks
2009-12-05 16:46:06   26600   ----a-w-   c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-05 16:46:06   107368   ----a-w-   c:\windows\system32\GEARAspi.dll
2009-12-05 16:44:49   0   d-----w-   c:\program files\iPod
2009-12-05 16:44:40   0   d-----w-   c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-05 16:44:39   0   d-----w-   c:\program files\iTunes
2009-12-05 16:44:03   0   d-----w-   c:\program files\Bonjour
2009-12-05 16:42:12   40448   ----a-w-   c:\windows\system32\drivers\usbaapl.sys
2009-12-05 16:42:12   2065696   ----a-w-   c:\windows\system32\usbaaplrc.dll

==================== Find3M  ====================

2009-12-22 02:23:01   140503   ----a-w-   c:\windows\hpoins14.dat
2009-11-03 01:42:06   195456   ------w-   c:\windows\system32\MpSigStub.exe
2009-10-29 07:45:38   916480   ----a-w-   c:\windows\system32\wininet.dll
2009-10-21 05:38:36   75776   ----a-w-   c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36   25088   ----a-w-   c:\windows\system32\httpapi.dll
2009-10-13 10:30:16   270336   ----a-w-   c:\windows\system32\oakley.dll
2009-10-12 13:38:19   149504   ----a-w-   c:\windows\system32\rastls.dll
2009-10-12 13:38:18   79872   ----a-w-   c:\windows\system32\raschap.dll
2009-08-13 17:16:14   16384   -csha-w-   c:\windows\system32\config\systemprofile\cookies\index.dat
2009-08-13 17:16:14   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2009-08-13 17:16:05   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009081320090814\index.dat
2009-08-13 17:16:14   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 18:00:59.24 ===============


[attachment deleted by admin]

[Derek]

defender has removed part of the malware but not all


In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

then you should have internet connection so we can fix the rest of the malware

Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  
• Remember to re enable the protection again after combofix has finished
  

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you. 
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.