This site is hosted at Hostgator.com

## Welcome to The Spykiller

You need to register to  get help with malware cleaning on your computer or take part in the general discussion forums and to upload files that have been requested from other forums. Unfortunately we are getting massive spam attacks from allowing guest postings to uploads
It takes a very long time and a lot of hard work on our part to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare so a large part of our time is spent helping you

### INSTRUCTIONS - Read This Before Posting For Malware Removal Help

#### Sehbahz

• Guest
« on: December 31, 2009, 00:03:22 »
Well yesterday, my computer had one of those trojan virus things. So i opened windows defender and did a full system scan and it recognized the trojan. It asked me what to do so i clicked "remove". So it either got removed or "quarantined". Now Internet Explorer won"t work. I click it; butit says it can't connect to eh internet. I do have internet connectivity though because america online opens up and it lets me log into aim, and windows live messenger. I don't what to do or what happened ?

DDS (Ver_09-12-01.01) - NTFSx86
Run by Owner GX260 at 18:00:03.99 on Wed 12/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.499 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)   {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\AOL\1255456668\ee\aolsoftware.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Telmex\Telmex.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
uRun: [eyeBeam SIP Client] "c:\program files\telmex\Telmex.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US /HIDEBL
uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
uRun: [gjtdhuci] c:\documents and settings\administrator\local settings\application data\warmbt\dymrsysguard.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [gjtdhuci] c:\documents and settings\administrator\local settings\application data\warmbt\dymrsysguard.exe
mRun: [HostManager] c:\program files\common files\aol\1255456668\ee\AOLSoftware.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1221933485697
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll
LSA: Notification Packages = scecli c:\windows\system32\zoheyayi.dll
Hosts: 127.0.0.1   www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-14 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-14 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-14 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-14 297752]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-8-14 908056]

=============== Created Last 30 ================

2009-12-25 19:41:25   0   d-----w-   c:\documents and settings\administrator\Contacts
2009-12-25 19:40:43   268   ---ha-w-   C:\sqmdata07.sqm
2009-12-25 19:40:43   244   ---ha-w-   C:\sqmnoopt07.sqm
2009-12-22 21:52:23   268   ---ha-w-   C:\sqmdata06.sqm
2009-12-22 21:52:23   244   ---ha-w-   C:\sqmnoopt06.sqm
2009-12-22 02:13:02   1470   ------w-   c:\windows\hpomdl12.dat
2009-12-22 02:13:02   130953   ----a-w-   c:\windows\hpoins12.dat
2009-12-16 22:41:20   268   ---ha-w-   C:\sqmdata05.sqm
2009-12-16 22:41:20   244   ---ha-w-   C:\sqmnoopt05.sqm
2009-12-15 20:20:35   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-12-15 20:20:30   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-12-15 03:24:49   268   ---ha-w-   C:\sqmdata04.sqm
2009-12-15 03:24:49   244   ---ha-w-   C:\sqmnoopt04.sqm
2009-12-13 13:44:16   268   ---ha-w-   C:\sqmdata03.sqm
2009-12-13 13:44:16   244   ---ha-w-   C:\sqmnoopt03.sqm
2009-12-12 01:52:33   268   ---ha-w-   C:\sqmdata02.sqm
2009-12-12 01:52:33   244   ---ha-w-   C:\sqmnoopt02.sqm
2009-12-11 03:38:04   268   ---ha-w-   C:\sqmdata01.sqm
2009-12-11 03:38:04   244   ---ha-w-   C:\sqmnoopt01.sqm
2009-12-10 08:19:48   268   ---ha-w-   C:\sqmdata00.sqm
2009-12-10 08:19:48   244   ---ha-w-   C:\sqmnoopt00.sqm
2009-12-07 01:07:42   0   d-----w-   c:\program files\Mozilla ActiveX Control v1.7.12
2009-12-07 01:06:47   0   d-----w-   c:\program files\VideoLAN
2009-12-07 01:04:44   0   d-----w-   c:\program files\Graboid
2009-12-06 02:20:59   0   d-----w-   c:\program files\BluetoothWorks
2009-12-05 16:46:06   26600   ----a-w-   c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-05 16:46:06   107368   ----a-w-   c:\windows\system32\GEARAspi.dll
2009-12-05 16:44:49   0   d-----w-   c:\program files\iPod
2009-12-05 16:44:40   0   d-----w-   c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-05 16:44:39   0   d-----w-   c:\program files\iTunes
2009-12-05 16:44:03   0   d-----w-   c:\program files\Bonjour
2009-12-05 16:42:12   40448   ----a-w-   c:\windows\system32\drivers\usbaapl.sys
2009-12-05 16:42:12   2065696   ----a-w-   c:\windows\system32\usbaaplrc.dll

==================== Find3M  ====================

2009-12-22 02:23:01   140503   ----a-w-   c:\windows\hpoins14.dat
2009-11-03 01:42:06   195456   ------w-   c:\windows\system32\MpSigStub.exe
2009-10-29 07:45:38   916480   ----a-w-   c:\windows\system32\wininet.dll
2009-10-21 05:38:36   75776   ----a-w-   c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36   25088   ----a-w-   c:\windows\system32\httpapi.dll
2009-10-13 10:30:16   270336   ----a-w-   c:\windows\system32\oakley.dll
2009-10-12 13:38:19   149504   ----a-w-   c:\windows\system32\rastls.dll
2009-10-12 13:38:18   79872   ----a-w-   c:\windows\system32\raschap.dll
2009-08-13 17:16:14   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2009-08-13 17:16:05   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009081320090814\index.dat
2009-08-13 17:16:14   32768   -csha-w-   c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 18:00:59.24 ===============

#### Derek

• Posts: 11927
##### Re: This is what I had to upload i guess ?
« Reply #1 on: January 01, 2010, 12:11:37 »
defender has removed part of the malware but not all

In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

then you should have internet connection so we can fix the rest of the malware

Delete any existing version of ComboFix you have sitting on your desktop

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again after combofix has finished
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running
Double click on combofix.exe & follow the prompts.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.
Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

### Donations

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £