AVG-Windows update failure Closed

Question

Hello,
I have got problem with updates ,I think there is new kind of virus type that effecting computor to browse Windows update-antivirus web page update even to open all other antivirus sites at the same time.
it is really a strange type.
I use AVG 8.0 free type addition and surely cannot update+open www.avg.com site to update +to browse any other latest antivirus sites to load latest antivirus editions downloads to solve my problem.
Please help how to solve it.

TheParoxysm · Accepted Answer

The chances of this being a virus is low.
The chances of this being non-viral malware is extremely high.



Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en...HJTInstall.exe

Then post the contents of the HJT log here.

Also! this could also be a malware that has edited your host file.  Meaning, whenever you look to surf antivirus or antispyware/malware websites, it redirects you to the address of your own internet port! Which is a pain in the butt!

So look at your "host" file, that is,
C:\windows\system32\drivers\etc\hosts. (hosts has no extention; it is just
"hosts".)

(Note, you may need to change windows explorer setting to allow seeing
system and hidden files.)

This file can be used to bypass a DNS server, effectively equating a web
address to a specific place. However, it can also be used to short-circuit
any website, pointing back to the local PC. That is a great way to block
advertsiements, but it could also be used to prevent access to specific
websites, like antivirus.

The minimum contents of a hostfile file is the one line below:

127.0.0.1 localhost

Other lines are optional.

For example, to block a webiste called www.ads.active.com", add a line like:

127.0.0.1 ads.active.com

Placing a "#" in column one of a line makes it a comment.

TheParoxysm · Answer

I would definitely try to use HiJack this.

jd · Answer

my computer has also been blocked for over a week now.

windows update blocked

antivirus update blocked

fix it pages and  HIJACK fixes all blocked.

Even SYSTEM RESTORE is blocked!

the HP  tools I burned onto a CD that is supposed to boot the computer is also blocked.


this is a MAJOR issue.  if you get it, you will understand.  I never dreamed that I'd be crippled to this extent.
It seems that the problem gets worse with every attempted fix.

it starts out with a HIJACKED browser ... search results on yahoo or google are redirected to websites that are related to the search, but not what I selected ... basically SPAM

i've tried 5 browsers:  Opera  Maxtor   IE   Safari  and FIREFOX .... all browsers were the latest edition.  ALL browsers are affected.

i tried to back up my data files ... even purchased a new portable hard drive ... but the backup process is interrupted and shuts down every time.
i was able to back up in small sizes by avoiding the spots that cause a hang up ... but this type of backup is not exactly reliable ...  20 backups of bits and pieces.

something is seriously screwy.

if you don't have it, you're darn lucky.   this is the first problem that I've been unable to solve in years.

jd · Answer

I have this same virus...this is the first site I've found that has an idea of whats going on....

bobby · Answer

I have it too. Not sure how I got it as we don't visit suspicious sites. Hijacked the browser and then blocks all anti-virus sites. If you get hijacked then disconnect form internet at once.

Gevulde Kex · Answer

Trojan Remover seems to have worked. I tried Morphine's list, some of the sites wouldn't open or the programs wouldn't start just like all the security programs I had already.
Now I can upgrade again. This is TR's log:

***** THE SYSTEM HAS BEEN RESTARTED *****
03/01/2009 14.25.03: Trojan Remover has been restarted
----------
Cleaning up TDSS keys/files:
   HKLM\SOFTWARE\TDSS - key (and subkeys) deleted
   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata - key (and subkeys) deleted
   C:\WINDOWS\system32\TDSSoipa.dll - deleted
   C:\WINDOWS\system32\TDSSmupe.dat - deleted
   C:\WINDOWS\system32\TDSSirxy.dll - deleted
   C:\WINDOWS\system32\TDSSyavu.dll - deleted
   C:\WINDOWS\system32\TDSSncur.dll - deleted
   C:\WINDOWS\system32\TDSSqxnr.dll - deleted
   C:\WINDOWS\system32\TDSSwgod.log - deleted
----------
=======================================================
Removing the following registry keys:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSmhoe.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDSSmhoe.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys - removed
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv) - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys) - already removed (or did not exist)
=======================================================
03/01/2009 14.25.03: Trojan Remover closed
************************************************************


***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.5.2559. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 14.16.05 03 gen 2009
Using Database v7248
Operating System:  Windows XP SP3 [Windows XP Professional Service Pack 3 (Build 2600)]
File System:       NTFS
Data directory:     C:\Documents and Settings\Raf\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Documents and Settings\Raf\My Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
AVG Anti-Virus

************************************************************

The regfile\shell\open\command Registry Key appears to have been modified.
The current Registry entry is: "regedit.exe" "%1".
This entry calls the following file:
C:\WINDOWSegedit.exe
Trojan Remover has restored the Registry regfile\shell\open key.
--------------------

************************************************************
14.16.20: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
14.16.20: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
14.16.20: ----- SCANNING FOR ROOTKIT SERVICES -----
Hidden Service Keyname: TDSSserv.sys
C:\WINDOWS\system32\drivers\TDSSmhoe.sys appears to contain: BACKDOOR.TDSS
C:\WINDOWS\system32\drivers\TDSSmhoe.sys - file backed up to C:\WINDOWS\system32\drivers\TDSSmhoe.sys.vir
C:\WINDOWS\system32\drivers\TDSSmhoe.sys - file has been erased using RAW erasure

************************************************************
14.16.46: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1033728 bytes
Created:  16/01/2007
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26112 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
514560 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: IMJPMIG8.1
Value Data: "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE
208952 bytes
Created:  18/01/2008
Modified: 16/01/2007
Company:  Microsoft Corporation
--------------------
Value Name: PHIME2002ASync
Value Data: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
455168 bytes
Created:  18/01/2008
Modified: 03/08/2004
Company:  Microsoft Corporation
--------------------
Value Name: PHIME2002A
Value Data: C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
455168 bytes
Created:  18/01/2008
Modified: 03/08/2004
Company:  Microsoft Corporation
--------------------
Value Name: Persistence
Value Data: C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxpers.exe
-R- 135168 bytes
Created:  18/01/2008
Modified: 13/01/2007
Company:  Intel Corporation
--------------------
Value Name: NvCplDaemon
Value Data: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
C:\WINDOWS\system32\NvCpl.dll
13574144 bytes
Created:  05/12/2007
Modified: 07/10/2008
Company:  NVIDIA Corporation
--------------------
Value Name: nwiz
Value Data: nwiz.exe /install
C:\WINDOWS\system32
wiz.exe
1630208 bytes
Created:  05/12/2007
Modified: 07/10/2008
Company:  NVIDIA Corporation
--------------------
Value Name: AVG8_TRAY
Value Data: C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
1261336 bytes
Created:  04/07/2008
Modified: 27/11/2008
Company:  AVG Technologies CZ, s.r.o.
--------------------
Value Name: NvMediaCenter
Value Data: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
C:\WINDOWS\system32\NvMcTray.dll
86016 bytes
Created:  05/12/2007
Modified: 07/10/2008
Company:  NVIDIA Corporation
--------------------
Value Name: BluetoothAuthenticationAgent
Value Data: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
C:\WINDOWS\system32\bthprops.cpl
110592 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1231752 bytes
Created:  03/01/2009
Modified: 01/01/2009
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
Value Name: DAEMON Tools Lite
Value Data: "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
C:\Program Files\DAEMON Tools Lite\daemon.exe
486856 bytes
Created:  17/01/2008
Modified: 17/01/2008
Company:  DT Soft Ltd
--------------------
Value Name: NVIDIA nTune
Value Data: "C:\Program Files\NVIDIA Corporation
Tune
TuneCmd.exe" clear
C:\Program Files\NVIDIA Corporation
Tune
TuneCmd.exe
81920 bytes
Created:  04/09/2007
Modified: 04/09/2007
Company:  NVIDIA
--------------------
Value Name: CTZDetec.exe
Value Data: C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
368640 bytes
Created:  22/01/2008
Modified: 24/04/2008
Company:  Creative Technology Ltd.
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty

************************************************************
14.16.47: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File:      shell32.dll - this file is expected and has been left in place
----------

************************************************************
14.16.47: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
14.16.47: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\logon.scr
220672 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
--------------------

************************************************************
14.16.47: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************
14.16.47: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  BthServ
Path: %SystemRoot%\System32\bthserv.dll
C:\WINDOWS\System32\bthserv.dll
30208 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
--------------------
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
14.16.48: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       ASPI
ImagePath: \??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys
C:\WINDOWS\System32\DRIVERS\ASPI32.sys
16512 bytes
Created:  07/03/2008
Modified: 17/07/2002
Company:  Adaptec
----------
Key:       atksgt
ImagePath: system32\DRIVERS\atksgt.sys
C:\WINDOWS\system32\DRIVERS\atksgt.sys
278728 bytes
Created:  22/12/2008
Modified: 22/12/2008
Company:  [no info]
----------
Key:       avg8emc
ImagePath: C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
875288 bytes
Created:  04/07/2008
Modified: 30/08/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       avg8wd
ImagePath: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
231704 bytes
Created:  04/07/2008
Modified: 30/08/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgLdx86
ImagePath: \SystemRoot\System32\Drivers\avgldx86.sys
C:\WINDOWS\System32\Drivers\avgldx86.sys
97928 bytes
Created:  23/05/2008
Modified: 30/08/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgMfx86
ImagePath: \SystemRoot\System32\Drivers\avgmfx86.sys
C:\WINDOWS\System32\Drivers\avgmfx86.sys
26824 bytes
Created:  18/01/2008
Modified: 04/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgTdiX
ImagePath: \SystemRoot\System32\Drivers\avgtdix.sys
C:\WINDOWS\System32\Drivers\avgtdix.sys
76040 bytes
Created:  23/05/2008
Modified: 04/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       BlueletAudio
ImagePath: system32\DRIVERS\blueletaudio.sys
C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [file not found to scan]
----------
Key:       BlueletSCOAudio
ImagePath: system32\DRIVERS\BlueletSCOAudio.sys
C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys [file not found to scan]
----------
Key:       Bonjour Service
ImagePath: "C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Program Files\Bonjour\mDNSResponder.exe
229376 bytes
Created:  28/02/2006
Modified: 28/02/2006
Company:  Apple Computer, Inc.
----------
Key:       BT
ImagePath: system32\DRIVERS\btnetdrv.sys
C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [file not found to scan]
----------
Key:       Btcsrusb
ImagePath: System32\Drivers\btcusb.sys
C:\WINDOWS\System32\Drivers\btcusb.sys [file not found to scan]
----------
Key:       BthEnum
ImagePath: system32\DRIVERS\BthEnum.sys
C:\WINDOWS\system32\DRIVERS\BthEnum.sys
17024 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       BTHidEnum
ImagePath: System32\Drivers\vbtenum.sys
C:\WINDOWS\System32\Drivers\vbtenum.sys [file not found to scan]
----------
Key:       BTHidMgr
ImagePath: System32\Drivers\BTHidMgr.sys
C:\WINDOWS\System32\Drivers\BTHidMgr.sys [file not found to scan]
----------
Key:       BTHMODEM
ImagePath: system32\DRIVERS\bthmodem.sys
C:\WINDOWS\system32\DRIVERS\bthmodem.sys
37888 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       BthPan
ImagePath: system32\DRIVERS\bthpan.sys
C:\WINDOWS\system32\DRIVERS\bthpan.sys
101120 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       BTHPORT
ImagePath: System32\Drivers\BTHport.sys
C:\WINDOWS\System32\Drivers\BTHport.sys
273024 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       BTHUSB
ImagePath: System32\Drivers\BTHUSB.sys
C:\WINDOWS\System32\Drivers\BTHUSB.sys
18944 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       CLEDX
ImagePath: system32\DRIVERS\cledx.sys
C:\WINDOWS\system32\DRIVERS\cledx.sys
33792 bytes
Created:  16/03/2008
Modified: 09/05/2005
Company:  Team H2O
----------
Key:       CTDevice_Srv
ImagePath: C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
61440 bytes
Created:  02/04/2007
Modified: 02/04/2007
Company:  Creative Technology Ltd
----------
Key:       dmxfire
ImagePath: system32\drivers\dmx6fire.sys
C:\WINDOWS\system32\drivers\dmx6fire.sys
148724 bytes
Created:  29/08/2003
Modified: 29/08/2003
Company:  Terratec Electronic GmbH
----------
Key:       dmxsens
ImagePath: system32\drivers\dmxsens.sys
C:\WINDOWS\system32\drivers\dmxsens.sys
403968 bytes
Created:  22/07/2003
Modified: 22/07/2003
Company:  Sensaura Ltd
----------
Key:       EagleNT
ImagePath: \??\C:\WINDOWS\system32\drivers\EagleNT.sys
C:\WINDOWS\system32\drivers\EagleNT.sys [file not found to scan]
----------
Key:       FLEXnet Licensing Service
ImagePath: "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
655624 bytes
Created:  18/01/2008
Modified: 19/11/2008
Company:  Acresso Software Inc.
----------
Key:       ialm
ImagePath: system32\DRIVERS\igxpmp32.sys
C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
-R- 5672032 bytes
Created:  18/01/2008
Modified: 13/01/2007
Company:  Intel Corporation
----------
Key:       IDriverT
ImagePath: "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
69632 bytes
Created:  14/11/2005
Modified: 14/11/2005
Company:  Macrovision Corporation
----------
Key:       irsir
ImagePath: system32\DRIVERS\irsir.sys
C:\WINDOWS\system32\DRIVERS\irsir.sys
18688 bytes
Created:  18/01/2008
Modified: 17/08/2001
Company:  Microsoft Corporation
----------
Key:       lirsgt
ImagePath: system32\DRIVERS\lirsgt.sys
C:\WINDOWS\system32\DRIVERS\lirsgt.sys
25416 bytes
Created:  22/12/2008
Modified: 22/12/2008
Company:  [no info]
----------
Key:       mcdbus
ImagePath: system32\DRIVERS\mcdbus.sys
C:\WINDOWS\system32\DRIVERS\mcdbus.sys [file not found to scan]
----------
Key:       NMIndexingService
ImagePath: "C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe"
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
382248 bytes
Created:  20/09/2007
Modified: 20/09/2007
Company:  Nero AG
----------
Key:       nocashio
ImagePath: system32\drivers
ocashio.sys
C:\WINDOWS\system32\drivers
ocashio.sys
4096 bytes
Created:  12/05/2008
Modified: 12/05/2008
Company:  [no info]
----------
Key:       nTuneService
ImagePath: C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe /StartService
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe 
131072 bytes
Created:  04/09/2007
Modified: 04/09/2007
Company:  NVIDIA
----------
Key:       NVR0Dev
ImagePath: \??\C:\WINDOWS
voclock.sys
C:\WINDOWS
voclock.sys
29696 bytes
Created:  04/09/2007
Modified: 04/09/2007
Company:  NVidia Corp.
----------
Key:       pcouffin
ImagePath: System32\Drivers\pcouffin.sys
C:\WINDOWS\System32\Drivers\pcouffin.sys
47360 bytes
Created:  27/11/2008
Modified: 27/11/2008
Company:  VSO Software
----------
Key:       PnkBstrA
ImagePath: C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrA.exe
66872 bytes
Created:  20/01/2008
Modified: 21/11/2008
Company:  [no info]
----------
Key:       RFCOMM
ImagePath: system32\DRIVERSfcomm.sys
C:\WINDOWS\system32\DRIVERSfcomm.sys
59136 bytes
Created:  12/12/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       RivaTuner32
ImagePath: \??\C:\Program Files\RivaTuner v2.20\RivaTuner32.sys
C:\Program Files\RivaTuner v2.20\RivaTuner32.sys
9088 bytes
Created:  19/11/2008
Modified: 19/11/2008
Company:  [no info]
----------
Key:       sptd
ImagePath: System32\Drivers\sptd.sys - this file is globally excluded
----------
Key:       sr
ImagePath: \SystemRoot\system32\DRIVERS\sr.sys
C:\WINDOWS\system32\DRIVERS\sr.sys
73472 bytes
Created:  18/01/2008
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{9C06143E-7556-458C-95F3-F86B10C31391}
C:\WINDOWS\system32\dllhost.exe 
5120 bytes
Created:  04/08/2004
Modified: 14/04/2008
Company:  Microsoft Corporation
----------
Key:       trutil
ImagePath: \??\C:\DOCUME~1\Raf\LOCALS~1\Temp	rutil.sys - this file is a Trojan Remover component
----------
Key:       UnlockerDriver5
ImagePath: \??\C:\Program Files\Unlocker\UnlockerDriver5.sys
C:\Program Files\Unlocker\UnlockerDriver5.sys
4096 bytes
Created:  07/09/2006
Modified: 07/09/2006
Company:  [no info]
----------
Key:       usbsermpt
ImagePath: system32\DRIVERS\usbsermpt.sys
C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
22768 bytes
Created:  21/05/2008
Modified: 21/05/2008
Company:  Microsoft Corporation
----------
Key:       Useless
ImagePath: \??\C:\Kaizoku_Script\KEngine\Dll\Useless.sys
C:\Kaizoku_Script\KEngine\Dll\Useless.sys [file not found to scan]
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
C:\Program Files\Windows Live\Messenger\usnsvc.exe
98840 bytes
Created:  07/11/2007
Modified: 07/11/2007
Company:  Microsoft Corporation
----------
Key:       VComm
ImagePath: system32\DRIVERS\VComm.sys
C:\WINDOWS\system32\DRIVERS\VComm.sys [file not found to scan]
----------
Key:       VcommMgr
ImagePath: System32\Drivers\VcommMgr.sys
C:\WINDOWS\System32\Drivers\VcommMgr.sys [file not found to scan]
----------
Key:       VirtualFD
ImagePath: \??\D:\Accumulator\vfd21-080206\vfd.sys
D:\Accumulator\vfd21-080206\vfd.sys [file not found to scan]
----------
Key:       WMConnectCDS
ImagePath: C:\Program Files\Windows Media Connect 2\wmccds.exe
C:\Program Files\Windows Media Connect 2\wmccds.exe
855552 bytes
Created:  18/01/2008
Modified: 06/10/2005
Company:  Microsoft Corporation
----------
Key:       {DEF85C80-216A-43ab-AF70-1665EDBE2780}
ImagePath: \??\C:\WINDOWS\TEMP\60.tmp
C:\WINDOWS\TEMP\60.tmp [file not found to scan]
----------

************************************************************
14.16.53: Scanning -----VXD ENTRIES-----

************************************************************
14.16.53: Scanning ----- WINLOGON\NOTIFY DLLS -----
Key    : igfxcui
DLLName: igfxdev.dll
C:\WINDOWS\system32\igfxdev.dll
-R- 204800 bytes
Created:  18/01/2008
Modified: 13/01/2007
Company:  Intel Corporation
----------

************************************************************
14.16.53: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   Adobe.Acrobat.ContextMenu
CLSID: {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}
Path:  C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
677504 bytes
Created:  22/10/2006
Modified: 22/10/2006
Company:  Adobe Systems Inc.
----------
Key:   AVG8 Shell Extension
CLSID: {9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
Path:  C:\Program Files\AVG\AVG8\avgse.dll
C:\Program Files\AVG\AVG8\avgse.dll
99608 bytes
Created:  04/07/2008
Modified: 04/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------
Key:   PowerISO
CLSID: {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
Path:  C:\Program Files\PowerISO\PWRISOSH.DLL
C:\Program Files\PowerISO\PWRISOSH.DLL
208896 bytes
Created:  20/01/2008
Modified: 20/01/2008
Company:  PowerISO Computing, Inc.
----------
Key:   TagRename_ContextMenu
CLSID: {7C5E74A0-D5E0-11D0-A9BF-E886A83B9BE5}
Path:  C:\PROGRA~1\TAGREN~1\TRshell.dll
C:\PROGRA~1\TAGREN~1\TRshell.dll
144640 bytes
Created:  15/02/2008
Modified: 05/12/2007
Company:  Softpointer Inc
----------

************************************************************
14.16.53: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key:  {7A5117B0-B594-4DA8-829D-D15BF11996F2}
File: C:\Program Files\DAEMON Tools Lite\awxDTools.dll
C:\Program Files\DAEMON Tools Lite\awxDTools.dll
151552 bytes
Created:  18/01/2008
Modified: 27/03/2006
Company:  arniWORX
----------
Key:  {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}
File: "C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"
C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
357888 bytes
Created:  28/08/2008
Modified: 28/08/2008
Company:  Sun Microsystems, Inc.
----------

************************************************************
14.16.53: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created:  22/10/2006
Modified: 22/10/2006
Company:  Adobe Systems Incorporated
----------
Key: {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}
BHO: C:\Program Files\Winamp Toolbar\winamptb.dll
C:\Program Files\Winamp Toolbar\winamptb.dll
1267040 bytes
Created:  19/03/2008
Modified: 19/03/2008
Company:  AOL LLC.
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\PROGRA~1\SPYBOT~1\SDHelper.dll
C:\PROGRA~1\SPYBOT~1\SDHelper.dll - file is excluded from scanning [SPYBOT S&D file]
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created:  10/11/2008
Modified: 10/06/2008
Company:  Sun Microsystems, Inc.
----------
Key: {AE7CD045-E861-484f-8273-0445EE161910}
BHO: C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
321120 bytes
Created:  22/10/2006
Modified: 22/10/2006
Company:  Adobe Systems Incorporated
----------

************************************************************
14.16.54: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
14.16.54: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
14.16.54: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
14.16.54: Scanning ----- APPINIT_DLLS -----
The HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key appears to be locked
AppInitDLLs entry = [avgrsstx.dll]
File: avgrsstx.dll
C:\WINDOWS\system32\avgrsstx.dll
10520 bytes
Created:  23/05/2008
Modified: 04/07/2008
Company:  AVG Technologies CZ, s.r.o.
----------

************************************************************
14.16.54: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
14.16.54: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
-HS- 84 bytes
Created:  18/01/2008
Modified: 18/01/2008
Company:  [no info]
--------------------
C:\Program Files\TerraTec\DMX 6fire\DMX6Fire.exe
335872 bytes
Created:  18/01/2008
Modified: 29/08/2003
Company:  TerraTec Electronic GmbH
DMX 6fire 2496 ControlPanel.lnk - links to C:\Program Files\TerraTec\DMX 6fire\DMX6Fire.exe
--------------------

************************************************************
14.16.55: Scanning ------ USER STARTUP GROUPS ------
--------------------
Checking Startup Group for: Raf
[C:\Documents and Settings\Raf\START MENU\PROGRAMS\STARTUP]
The Startup Group for Raf attempts to load the following file(s):
C:\Documents and Settings\Raf\START MENU\PROGRAMS\STARTUP\desktop.ini
-HS- 84 bytes
Created:  18/01/2008
Modified: 18/01/2008
Company:  [no info]
----------

************************************************************
14.16.55: Scanning ----- SCHEDULED TASKS -----
No Scheduled Tasks found to scan

************************************************************
14.16.55: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
14.16.55: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
1 TDSS rootkit driver(s) heuristically detected
No specific TDSS rootkit drivers could be located - no action taken
-----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Raf\Application Data\IrfanView\IrfanView_Wallpaper.bmp
C:\Documents and Settings\Raf\Application Data\IrfanView\IrfanView_Wallpaper.bmp
3888054 bytes
Created:  18/01/2008
Modified: 01/01/2009
Company:  [no info]
----------
Web Desktop Wallpaper: %SystemRoot%\web\wallpaper\Bliss.bmp
C:\WINDOWS\web\wallpaper\Bliss.bmp
1440054 bytes
Created:  18/01/2008
Modified: 18/01/2008
Company:  [no info]
----------
Checks for rogue DNS NameServers completed
----------
Additional checks completed

************************************************************
14.17.05: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[15 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[74 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[41 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[59 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[68 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[45 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[140 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[36 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[44 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
[151 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[60 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgtray.exe - file already scanned
[49 loaded modules in total]
--------------------
C:\WINDOWS\system32\RUNDLL32.EXE
[35 loaded modules in total]
--------------------
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
[58 loaded modules in total]
--------------------
C:\WINDOWS\system32undll32.exe
[38 loaded modules in total]
--------------------
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[38 loaded modules in total]
--------------------
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe - file already scanned
[29 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe - file already scanned
[38 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[35 loaded modules in total]
--------------------
C:\WINDOWS\system32\CTsvcCDA.exe
[22 loaded modules in total]
--------------------
C:\Program Files\Creative\Shared Files\CTDevSrv.exe - file already scanned
[22 loaded modules in total]
--------------------
C:\WINDOWS\system32
vsvc32.exe
[40 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[44 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
[27 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgemc.exe - file already scanned
[66 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[34 loaded modules in total]
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
[86 loaded modules in total]
--------------------
C:\Documents and Settings\Raf\Application Data\Simply Super Software\Trojan Remover\qri5E.exe
FileSize:          2913144
[This is a Trojan Remover component]
[65 loaded modules in total]
--------------------

************************************************************
14.17.39: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
14.17.39: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
14.17.39: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
14.17.39: Scanning ------ %TEMP% DIRECTORY ------
C:\DOCUME~1\Raf\LOCALS~1\Temp\etilqs_xCq1O2fXEr6pAmeLBAkT appears to be in-use/locked
************************************************************
14.17.51: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
14.17.51: Scanning ------ ROOT DIRECTORY ------

************************************************************
14.17.51: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
%SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=73960D15C3CC4942B0C871380AA65EA0{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=73960D15C3CC4942B0C871380AA65EA0{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 14.17.51 03 gen 2009
Total Scan time: 00.01.45
-------------------------------------------------------------------------
One or more files could not be moved or renamed as requested.
They may be in use by Windows, so Trojan Remover needs
to restart the system in order to deal with these files.
03/01/2009 14.17.57: restart commenced
************************************************************

thecoat · Answer

Just some technical info on this issue, working on my girl friends computer atm and she's having this issue.  Name resolution is being intercepted in some way.  Windows TCP/IP name resolution goes through several steps the first is to check the local systems dns cache.  The second is that it checks the hosts file.  I added www.agv.com with the correct address in the hosts file.  The address still resolved as 127.0.0.1 (localhost).  I then did an ipconfig /flushdns which should flush the dns cache on the local machine.  This also did not work and www.avg.com still resolved as 127.0.0.1. 

ipconfig /displaydns listed only two common correct entries in the dns cache.

This malware is intercepting windows dns resolution at the highest levels.  It is not messing with the windows dns cache or the hosts file as is typically the case with hijacks.

This does most likely mean that there is an actively executing program doing the hijack, or a replaced library to which a program is making calls.. most likely the former.  I'll post a solution if I find one.

airy · Answer

Trojan Remover did the trick! Been having this issue for about 24 hours now, ran 2 anti-virus and 3 anti-spyware with no luck. Run Trojan Remover!!

THANKS MORPHINE!!!!

Daver · Answer

WOW! I thought I was the only one with this problem! Thanks for helping morphine that did the trick! I noticed that I could use a proxy to get to AVG to update but it still didn't work but this sure did thanks a bunch!

valevonn · Answer

Morphine!!!! THANK YOU SO MUCH. Your link to the trojan removal did the trick. I've been dealing with this for a week and have tried EVERYTHING! Thanks for the tip. 

I just used the TR at your first link and everything seems to be running fine. I was able to update my AVG.  But I didn't use the other step you mentioned in your later post:
1) SmitFraudFix (normal) 
2) SmitFraudFix (safe mode) 
2) Spy Subtract 
3) SuperAnti Spyware 
4) Avira AntiSpywhere 
5) Trojan Remover 

Do I need to do steps 1-4?

tukk · Answer

Thanks a lot guys!!!! im now updating my avg. Thanks morphine.

Gallagher · Answer

Thanks for everything... Thats a nasty infection and one which I never want to see again! Does anyone have any more info on what it is or how it has got on to all these pcs? I for one know I havent been using dodgy sites and still got it??? please let me know if there is any info on what this is as it took me ages to get rid of! 

Cheers

YYZ Jim · Answer

I have (had) it too. Thanks to morphine for the List.
The first thing I noticed when it started to work again was the toolbar accross the top of the google page appeared again !!

fatherspeedy · Answer

Had the same problem after updating on or around xmas... It's all malware dude. I tried all the internet gimmicks - None worked. Solution was simple:  Scan your computer with an antivirus which support spyware, spam, rootkit etc.. (i used AVG security Center); then use (Malwarebytes' Anti-Malware) - it found about 30 malware on my machine. Erase malware found... Restart your computer!!! bang bang - my updates worked again... Note:  Keep a working antivirus/spyware/spamware software which is updated regularly... WORKS

NDGChicago · Answer

I tried three different anti-virus and two anti-spyware, but none of them could fix it. Trojan Remover did the magic, and it seems to be back to normal. Thanks for all your help, Morphine!

jmaccjr · Answer

This virus was the worst...I slowed down a fcked up my computer.. Thankfully I was able to surf the web to find valuable information like this to kill it... Good job Fellas

kcram · Answer

I have also encountered this problem and the Trojan Remover solved it.

thanks for this thread.

stressed · Answer

Mine started with spoofs telling me my machine needed virus protection and some crazy pop-up every 1-2mins. Then the error message forcing me to shut down.  I tried getting updates from all the (AV) sites with no luck.  Blank no connection or error message was all I could get.  I ran (AVG anti-rootkit) and that paved the way for me to go get all the updates.  Ran (microtrend housecall), (malwarebytes-anti-malware),  and (spybot).  Got the latest (AVG 8.0)

GTX_SlotCar · Answer

Trojan Remover worked for me, too. Thanks Morphine.  I don't know why that link worked when other wouldn't, maybe because the AV is buried in the link through google?

For those that missed it, the link is:
https://www.softpedia.com/get/Antivirus/Trojan-Remover.shtml

Just click it and hit the first download button and run the program.

MightySpear · Answer

Same problem on a friends computer. Trojan Remover worked!!!!

Chango · Answer

I have been having the same problem with multiple computers. I work in IT and this particular infection is driving me crazy. I first saw it 2 years ago and back then smifraudfix was ll you needed. Quick, simple and easy. This latest one is ridiculous. I have used Spybot S+D, AVG, Smitfraudfix, Super Anti-Spyware and now Trojan Remover wont even run. If anybody has any other possible ideas I would greatly appreciate it. I have run trojan remover in regular and safe modes. THe last time I tried to scan with it I got BSOD. I'm ready to start hitting my head on the keyboard to see if that will help!!!! Thanks in advance.

Metech25 · Answer

I am glad to see that I'm not the only one having this problem.  I consider myself to be fairly adept when it comes to computers and this has been the first problem of this type that I haven't been able to solve on my own.  I will be trying these steps when I get home tonight to see if it fixes my problems.  

Thanks in advance to all posters, in particular, Morphine.

SASMALTA · Answer

The virus was killed by Trojan Remover 675.
thanks Guys.

Attached is the log file
***** THE SYSTEM HAS BEEN RESTARTED *****
1/9/2009 11:35:46 AM: Trojan Remover has been restarted
----------
Cleaning up TDSS keys/files:
   HKLM\SOFTWARE\TDSS - key (and subkeys) deleted
   HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion	dssdata - key (and subkeys) deleted
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS - key (and subkeys) deleted
   C:\WINDOWS\system32\TDSSosvn.dll - deleted
   C:\WINDOWS\system32\TDSSnrsr.dat - deleted
   C:\WINDOWS\system32\TDSSnmxh.dll - deleted
   C:\WINDOWS\system32\TDSSsbhc.dll - deleted
   C:\WINDOWS\system32\TDSSthym.dll - deleted
   C:\WINDOWS\system32\TDSStkdv.dll - deleted
   C:\WINDOWS\system32\TDSSkpjp.log - deleted
----------
=======================================================
Removing the following registry keys:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSoeqh.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDSSoeqh.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal	dsspaxt.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network	dsspaxt.sys - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys - removed
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv) - already removed (or did not exist)
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys) - already removed (or did not exist)
=======================================================
1/9/2009 11:35:46 AM: Trojan Remover closed
************************************************************


***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.5.2560. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 11:32:43 AM 09 Jan 2009
Using Database v7254
Operating System:  Windows XP SP3 [Windows XP Professional Service Pack 3 (Build 2600)]
File System:       NTFS
Data directory:     C:\Documents and Settings\Norman\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Documents and Settings\Norman\My Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
Microsoft Windows Defender
AVG Anti-Virus

************************************************************


************************************************************
11:32:43 AM: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
11:32:43 AM: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
11:32:43 AM: ----- SCANNING FOR ROOTKIT SERVICES -----
Hidden Service Keyname: TDSSserv.sys
C:\WINDOWS\system32\drivers\TDSSoeqh.sys appears to contain: BACKDOOR.TDSS
C:\WINDOWS\system32\drivers\TDSSoeqh.sys - file backed up to C:\WINDOWS\system32\drivers\TDSSoeqh.sys.vir
C:\WINDOWS\system32\drivers\TDSSoeqh.sys - file has been erased using RAW erasure

************************************************************
11:33:05 AM: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1033728 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26112 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
514560 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: IgfxTray
Value Data: C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxtray.exe
-R- 98304 bytes
Created:  6/1/2008
Modified: 10/5/2006
Company:  Intel Corporation
--------------------
Value Name: HotKeysCmds
Value Data: C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\hkcmd.exe
-R- 114688 bytes
Created:  6/1/2008
Modified: 10/5/2006
Company:  Intel Corporation
--------------------
Value Name: Persistence
Value Data: C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxpers.exe
-R- 94208 bytes
Created:  6/1/2008
Modified: 10/5/2006
Company:  Intel Corporation
--------------------
Value Name: RTHDCPL
Value Data: RTHDCPL.EXE
C:\WINDOWS\RTHDCPL.EXE
-R- 16126464 bytes
Created:  6/1/2008
Modified: 4/10/2007
Company:  Realtek Semiconductor Corp.
--------------------
Value Name: SkyTel
Value Data: SkyTel.EXE
C:\WINDOWS\SkyTel.EXE
-R- 1822720 bytes
Created:  6/1/2008
Modified: 4/4/2007
Company:  Realtek Semiconductor Corp.
--------------------
Value Name: Alcmtr
Value Data: ALCMTR.EXE
C:\WINDOWS\ALCMTR.EXE
-R- 69632 bytes
Created:  6/1/2008
Modified: 5/3/2005
Company:  Realtek Semiconductor Corp.
--------------------
Value Name: CmUCRRun
Value Data: C:\WINDOWS\system32\CmUCReye.exe
C:\WINDOWS\system32\CmUCReye.exe
-R- 237568 bytes
Created:  7/28/2008
Modified: 7/11/2006
Company:  
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe"
C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe
75520 bytes
Created:  10/12/2008
Modified: 5/2/2007
Company:  Sun Microsystems, Inc.
--------------------
Value Name: Adobe Reader Speed Launcher
Value Data: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
39792 bytes
Created:  10/15/2008
Modified: 10/15/2008
Company:  Adobe Systems Incorporated
--------------------
Value Name: Hiyo
Value Data: C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup
C:\Program Files\HiYo\bin\HiYo.exe
300336 bytes
Created:  12/10/2008
Modified: 12/10/2008
Company:  IncrediMail, Ltd.
--------------------
Value Name: SweetIM
Value Data: C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
-R- 111928 bytes
Created:  12/2/2008
Modified: 12/2/2008
Company:  SweetIM Technologies Ltd.
--------------------
Value Name: Windows Defender
Value Data: "C:\Program Files\Windows Defender\MSASCui.exe" -hide
C:\Program Files\Windows Defender\MSASCui.exe
866584 bytes
Created:  11/3/2006
Modified: 11/3/2006
Company:  Microsoft Corporation
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
1231752 bytes
Created:  1/9/2009
Modified: 1/1/2009
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: msnmsgr
Value Data: ~"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
~ [file not found to scan]
--------------------
Value Name: SpybotSD TeaTimer
Value Data: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe - this entry is globally excluded
--------------------
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
This Registry Key appears to be empty

************************************************************
11:33:07 AM: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File:      shell32.dll - this file is expected and has been left in place
----------
ValueName: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}
Value:     Microsoft AntiMalware ShellExecuteHook
File:      C:\PROGRA~1\WIFD1F~1\MpShHook.dll
C:\PROGRA~1\WIFD1F~1\MpShHook.dll
83224 bytes
Created:  11/3/2006
Modified: 11/3/2006
Company:  Microsoft Corporation
----------

************************************************************
11:33:07 AM: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
11:33:07 AM: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\WINDOWS\System32\logon.scr
C:\WINDOWS\System32\logon.scr
220672 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
--------------------

************************************************************
11:33:07 AM: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----

************************************************************
11:33:07 AM: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------

************************************************************
11:33:08 AM: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       AnyDVD
ImagePath: System32\Drivers\AnyDVD.sys
C:\WINDOWS\System32\Drivers\AnyDVD.sys
97216 bytes
Created:  1/23/2008
Modified: 1/23/2008
Company:  SlySoft, Inc.
----------
Key:       AtcL002
ImagePath: system32\DRIVERS\l251x86.sys
C:\WINDOWS\system32\DRIVERS\l251x86.sys
-R- 29696 bytes
Created:  6/1/2008
Modified: 7/3/2007
Company:  Atheros Communications Inc.
----------
Key:       avg8emc
ImagePath: C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
875288 bytes
Created:  1/1/2009
Modified: 1/1/2009
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       avg8wd
ImagePath: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
231704 bytes
Created:  1/1/2009
Modified: 1/1/2009
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgLdx86
ImagePath: \SystemRoot\System32\Drivers\avgldx86.sys
C:\WINDOWS\System32\Drivers\avgldx86.sys
97928 bytes
Created:  1/1/2009
Modified: 1/1/2009
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgMfx86
ImagePath: \SystemRoot\System32\Drivers\avgmfx86.sys
C:\WINDOWS\System32\Drivers\avgmfx86.sys
26824 bytes
Created:  1/1/2009
Modified: 1/1/2009
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       AvgTdiX
ImagePath: \SystemRoot\System32\Drivers\avgtdix.sys
C:\WINDOWS\System32\Drivers\avgtdix.sys
76040 bytes
Created:  1/1/2009
Modified: 1/1/2009
Company:  AVG Technologies CZ, s.r.o.
----------
Key:       BandLuxe_Service
ImagePath: "C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe" -e
C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe
87264 bytes
Created:  8/19/2008
Modified: 8/19/2008
Company:  BandRich Inc.
----------
Key:       br3gmdm
ImagePath: system32\DRIVERS\br3gmdm.sys
C:\WINDOWS\system32\DRIVERS\br3gmdm.sys
104192 bytes
Created:  1/9/2009
Modified: 5/15/2008
Company:  BandRich Inc.
----------
Key:       CMISTOR
ImagePath: system32\DRIVERS\cmiucr.SYS
C:\WINDOWS\system32\DRIVERS\cmiucr.SYS
-R- 86912 bytes
Created:  7/28/2008
Modified: 7/14/2006
Company:  C-Media Corporation
----------
Key:       ElbyCDIO
ImagePath: System32\Drivers\ElbyCDIO.sys
C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
25160 bytes
Created:  8/7/2007
Modified: 8/7/2007
Company:  Elaborate Bytes AG
----------
Key:       gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
137200 bytes
Created:  10/20/2008
Modified: 12/20/2008
Company:  Google
----------
Key:       HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
49920 bytes
Created:  10/21/2005
Modified: 10/21/2005
Company:  HP
----------
Key:       HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
16496 bytes
Created:  10/21/2005
Modified: 10/21/2005
Company:  HP
----------
Key:       HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21456 bytes
Created:  10/22/2005
Modified: 3/9/2003
Company:  HP
----------
Key:       ialm
ImagePath: system32\DRIVERS\igxpmp32.sys
C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
-R- 1181824 bytes
Created:  6/1/2008
Modified: 10/5/2006
Company:  Intel Corporation
----------
Key:       MTsensor
ImagePath: system32\DRIVERS\ASACPI.sys
C:\WINDOWS\system32\DRIVERS\ASACPI.sys
-R- 5810 bytes
Created:  6/1/2008
Modified: 8/13/2004
Company:  
----------
Key:       rmcd
ImagePath: system32\drivers\xtbjifl.sys
C:\WINDOWS\system32\drivers\xtbjifl.sys [file not found to scan]
----------
Key:       SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{9BF17899-D048-4BDB-94DF-4E90CE781682}
C:\WINDOWS\system32\dllhost.exe 
5120 bytes
Created:  8/3/2004
Modified: 4/14/2008
Company:  Microsoft Corporation
----------
Key:       trutil
ImagePath: \??\C:\DOCUME~1\Norman\LOCALS~1\Temp	rutil.sys - this file is a Trojan Remover component
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
C:\Program Files\Windows Live\Messenger\usnsvc.exe
98328 bytes
Created:  10/18/2007
Modified: 10/18/2007
Company:  Microsoft Corporation
----------
Key:       WinDefend
ImagePath: "C:\Program Files\Windows Defender\MsMpEng.exe"
C:\Program Files\Windows Defender\MsMpEng.exe
13592 bytes
Created:  11/3/2006
Modified: 11/3/2006
Company:  Microsoft Corporation
----------
Key:       WLSetupSvc
ImagePath: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
266240 bytes
Created:  10/25/2007
Modified: 10/25/2007
Company:  Microsoft Corporation
----------

************************************************************
11:33:09 AM: Scanning -----VXD ENTRIES-----

************************************************************
11:33:09 AM: Scanning ----- WINLOGON\NOTIFY DLLS -----
Key    : igfxcui
DLLName: igfxdev.dll
C:\WINDOWS\system32\igfxdev.dll
-R- 155648 bytes
Created:  6/1/2008
Modified: 10/5/2006
Company:  Intel Corporation
----------

************************************************************
11:33:10 AM: Scanning ----- CONTEXTMENUHANDLERS -----

************************************************************
11:33:10 AM: Scanning ----- FOLDER\COLUMNHANDLERS -----

************************************************************
11:33:10 AM: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
BHO: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
62080 bytes
Created:  10/22/2006
Modified: 10/22/2006
Company:  Adobe Systems Incorporated
----------
Key: {53707962-6F74-2D53-2644-206D7942484F}
BHO: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll - file is excluded from scanning [SPYBOT S&D file]
----------
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
C:\Program Files\Java\jre1.5.0_12\bin\ssv.dll
440056 bytes
Created:  5/2/2007
Modified: 5/2/2007
Company:  Sun Microsystems, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
328752 bytes
Created:  9/20/2007
Modified: 9/20/2007
Company:  Microsoft Corporation
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
251504 bytes
Created:  12/20/2008
Modified: 12/20/2008
Company:  [no info]
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
657904 bytes
Created:  12/20/2008
Modified: 12/20/2008
Company:  Google Inc.
----------
Key: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E}
BHO: C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
522224 bytes
Created:  12/20/2008
Modified: 12/20/2008
Company:  Google Inc.
----------
Key: {EEE6C35C-6118-11DC-9C72-001320C79847}
BHO: C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
1172792 bytes
Created:  10/8/2008
Modified: 10/8/2008
Company:  SweetIM Technologies Ltd.
----------

************************************************************
11:33:10 AM: Scanning ----- SHELLSERVICEOBJECTS -----

************************************************************
11:33:10 AM: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
11:33:10 AM: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
11:33:10 AM: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank or does not exist

************************************************************
11:33:10 AM: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
11:33:10 AM: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
-HS- 84 bytes
Created:  6/1/2008
Modified: 6/1/2008
Company:  [no info]
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
147456 bytes
Created:  4/6/2003
Modified: 4/6/2003
Company:  Hewlett-Packard Co.
hp psc 1000 series.lnk - links to C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
28672 bytes
Created:  4/6/2003
Modified: 4/6/2003
Company:  Hewlett-Packard
hpoddt01.exe.lnk - links to C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
--------------------

************************************************************
11:33:11 AM: Scanning ------ USER STARTUP GROUPS ------
--------------------
Checking Startup Group for: Norman
[C:\Documents and Settings\Norman\START MENU\PROGRAMS\STARTUP]
The Startup Group for Norman attempts to load the following file(s):
C:\Documents and Settings\Norman\START MENU\PROGRAMS\STARTUP\desktop.ini
-HS- 84 bytes
Created:  1/2/2009
Modified: 6/1/2008
Company:  [no info]
----------
--------------------
Checking Startup Group for: Wayne
[C:\Documents and Settings\Wayne\START MENU\PROGRAMS\STARTUP]
The Startup Group for Wayne attempts to load the following file(s):
C:\Documents and Settings\Wayne\START MENU\PROGRAMS\STARTUP\desktop.ini
-HS- 84 bytes
Created:  10/2/2008
Modified: 6/1/2008
Company:  [no info]
----------
--------------------
Checking Startup Group for: XPUser
[C:\Documents and Settings\XPUser\START MENU\PROGRAMS\STARTUP]
The Startup Group for XPUser attempts to load the following file(s):
C:\Documents and Settings\XPUser\START MENU\PROGRAMS\STARTUP\desktop.ini
-HS- 84 bytes
Created:  6/1/2008
Modified: 6/1/2008
Company:  [no info]
----------

************************************************************
11:33:11 AM: Scanning ----- SCHEDULED TASKS -----
Taskname:      MP Scheduled Scan.job
File:          C:\Program Files\Windows Defender\MpCmdRun.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
293144 bytes
Created:  11/3/2006
Modified: 11/3/2006
Company:  Microsoft Corporation
Parameters:    Scan -RestrictPrivileges
Next Run Time: 1/9/2009 6:00:00 PM
Status:        The task has not yet run
Creator:       SYSTEM
Comments:      Scheduled Scan
----------

************************************************************
11:33:11 AM: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
11:33:11 AM: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
1 TDSS rootkit driver(s) heuristically detected
C:\WINDOWS\system32\drivers	dsspaxt.sys appears to contain: BACKDOOR.TDSS
C:\WINDOWS\system32\drivers	dsspaxt.sys - file backed up to C:\WINDOWS\system32\drivers	dsspaxt.sys.vir
C:\WINDOWS\system32\drivers	dsspaxt.sys - file has been erased using RAW erasure
-----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper entry is blank
----------
Web Desktop Wallpaper: %SystemRoot%\web\wallpaper\Bliss.bmp
C:\WINDOWS\web\wallpaper\Bliss.bmp
1440054 bytes
Created:  6/1/2008
Modified: 6/1/2008
Company:  [no info]
----------
DNS Server information:
Rogue DNS NameServers:
Interface:   
NameServers: 80.93.144.1 80.93.144.2
Checks for rogue DNS NameServers completed
----------
Additional checks completed

************************************************************
11:33:28 AM: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
[1 loaded module]
--------------------
C:\WINDOWS\system32\csrss.exe
[11 loaded modules in total]
--------------------
C:\WINDOWS\system32\winlogon.exe
[68 loaded modules in total]
--------------------
C:\WINDOWS\system32\services.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\system32\lsass.exe
[61 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe
[65 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[38 loaded modules in total]
--------------------
C:\Program Files\Windows Defender\MsMpEng.exe - file already scanned
[42 loaded modules in total]
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
[155 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[31 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[41 loaded modules in total]
--------------------
C:\WINDOWS\system32\spoolsv.exe
[57 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe - file already scanned
[36 loaded modules in total]
--------------------
C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe - file already scanned
[29 loaded modules in total]
--------------------
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
[27 loaded modules in total]
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
[44 loaded modules in total]
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
[112 loaded modules in total]
--------------------
C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\CManager.exe
[51 loaded modules in total]
--------------------
C:\WINDOWS\system32\igfxtray.exe - file already scanned
[33 loaded modules in total]
--------------------
C:\WINDOWS\system32\igfxpers.exe - file already scanned
[31 loaded modules in total]
--------------------
C:\WINDOWS\RTHDCPL.EXE - file already scanned
[41 loaded modules in total]
--------------------
C:\WINDOWS\system32\CmUCReye.exe - file already scanned
[38 loaded modules in total]
--------------------
C:\Program Files\HiYo\bin\HiYo.exe - file already scanned
[42 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
[23 loaded modules in total]
--------------------
C:\Program Files\Windows Defender\MSASCui.exe - file already scanned
[62 loaded modules in total]
--------------------
C:\WINDOWS\system32\ctfmon.exe - file already scanned
[31 loaded modules in total]
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
[44 loaded modules in total]
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
[35 loaded modules in total]
--------------------
C:\PROGRA~1\AVG\AVG8\avgemc.exe - file already scanned
[60 loaded modules in total]
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
[33 loaded modules in total]
--------------------
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
[44 loaded modules in total]
--------------------
C:\WINDOWS\System32\alg.exe
[32 loaded modules in total]
--------------------
C:\WINDOWS\system32\wscntfy.exe
[24 loaded modules in total]
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
[90 loaded modules in total]
--------------------
C:\Documents and Settings\Norman\Application Data\Simply Super Software\Trojan Remover\uku5.exe
FileSize:          2921336
[This is a Trojan Remover component]
[71 loaded modules in total]
--------------------

************************************************************
11:33:54 AM: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
11:33:54 AM: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
11:33:54 AM: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
11:33:54 AM: Scanning ------ %TEMP% DIRECTORY ------
C:\DOCUME~1\Norman\LOCALS~1\Temp\etilqs_Xkbrfg7sDcl14tV8HsDS appears to be in-use/locked
************************************************************
11:33:55 AM: Scanning ------ C:\WINDOWS\Temp DIRECTORY ------
************************************************************
11:33:58 AM: Scanning ------ ROOT DIRECTORY ------

************************************************************
11:33:58 AM: ------ Scan for other files to remove ------
No malware-related files found to remove

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=73960D15C3CC4942B0C871380AA65EA0{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=73960D15C3CC4942B0C871380AA65EA0{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
=== ONE OR MORE FILES WERE RENAMED OR REMOVED ===
Scan completed at: 11:33:58 AM 09 Jan 2009
Total Scan time: 00:01:15
-------------------------------------------------------------------------
One or more files could not be moved or renamed as requested.
They may be in use by Windows, so Trojan Remover needs
to restart the system in order to deal with these files.
1/9/2009 11:34:03 AM: restart commenced
************************************************************

Dae · Answer

Man... this was bananas. 
Had to call a friend at microsoft who told me how to even search for a solution which allowed me to find this site, TR, MBytes, etc...thanks for all the info and heads up. 
Everyone should spread the word... most folks have no clue what to do in this situation and given the spread of this issue, I'd assume that it's only going to get worse. 
Tell your friends!

-D

wahzaboy · Answer

Thanks for the help and hints on Trojan remover ! it worked like a charm and everything is fixed now. thought I still wonder how that thing got into my PC, it's for sure a nasty thing.

Rossco · Answer

To one and all, thank you so very much for helping me fix the inability to get AVG or Microsoft updates.
I too have now had the problem sorted by the Trojan Removal program.

Another thing that happened to our computer was that we couldn't make a restore point, nor could we use any previous restore points! That has also apparently been fixed.
It might be another thing to check on if anyone else has that problem. It may be related??!!
Thanks again people :-)

katalina713 · Answer

Hi, 

I have the same virus. I got it around the same time everyone else did (in Decemeber). I was able to download the trojan remover. However, I'm not able to install it. When I hit "open" or "run as" it doesn't do anything. The virus is blocking the installation. I had the same problem with a microsoft program. I downloaded microsoft program and burned it to a disk. I tried installing it from the disk and it wouldn't let me install it. 

How can I install the trojan remover? Does anyone have any suggestions? Is there somehting I can do manually to allow the installation? 

Thanks

Gerald · Answer

You guys and Trojan Remover saved the day!
I had 1 week of hell, trying to figure this one out and that having 15 years IT knowledge.

This was weird and there is not much info on the www.

BIG THANK YOU!!

Grateful Guy · Answer

Bless you, bless you, bless you for this stroke of insight on Trojan Remover!!!!

katalina713 · Answer

It worked! Renaming the installation file worked. The internet is working good now, but I did see a pop or two  appear. 

Does any one have any idea how they got the virus? My boyfriend thinks he got the virus from redtube.com Did anyone else view this website prior to receiving the virus?

sultan69 · Answer

i was up all night trying to kill this thing, with no luck.
every site I wanted to visit it would bring me somewhere else. It was pretty smart I must admit.
I have never been so concerned about viruses but after seeing this I was little annoyed.

thanks to your info. and most of all trojan remover which worked after 2nd try. the first time I ran it was in safe mode, didnt seem to solve the problem, when windows rebooted (normal) I scanned again and all seems to work since I am able to update all virus definitions. Moving to other tools now.

imsatan · Answer

Thanks for the Info Morphine I was having the same problem as most everyone here Trojan Remover worked like a charm. Sure beats reformatting the hard drive. Thanks again

evergratiful · Answer

It's been said dozens of times already, but THANKS!  Trojan Remover worked like a charm!  You guys are the best!

Shotgun Willy · Answer

THANKS FOR THE TIPS EVERYONE!!

I had this update blocker too. The Trojan Remover worked perfectly!

Thanks again!

Shotgun

whollygrael · Answer

I too have been the victim of this insidious malware. Not even MS's Malicious Software Removal Tool (January 2009) detected it. (Tool downloaded via an uninfected computer on my home network because even access to Microsoft website was consistently redirected to Google's search page). However, Trojan Remover did the trick!  

The idiocy of this sort of malware usually takes days to rectify and then only after reinstalling the OS, but the discussion here was invaluable. Saved me heaps of frustration, anger and time.

Thanks guys.

JT · Answer

thanks guys it worked for me ....I spent 5 hours trying to fix and I stumbled upon this fourum... lifesavers

Jake · Answer

I got Trojan remover to install but now it says it's expired?!  Any help with this?

SpAX · Answer

Hello. Now I have the same problem. I have tried plenty of different anti-virus software. And yet, unsuccessful. I can tell you, that NOD32, McAfee, Norton, Kaspersky won't find anything. AVG is good, but when you got the infection inside, it is useless. You won't be able to update any of them, not even Malwarebytes or access their websites (e.g. avg.com, symantec.com and so on...). And the "hosts" file has nothing to do with it!
But I have found a solution if you want to be able to update your anti-virus. Is has something to do with "svchost.exe" which can be seen in the task manager (ctrl+alt+dele > Processes). First of all, make a BAT file on your desktop (just make a TXT file and rename it's extension to .BAT). Open it with your right mouse and click edit. Put the following code:
------------------
@echo off
shutdown -a
cls
------------------
and save the file.

Now access the task manager and go to Processes. Start killing all the "svchost.exe" until you have none of them running. This will make a message with a shutdown appear on your screen. Run the BAT file, this will cancel the shutdown. Now when you kill all the "svchost.exe", you will be able to update your anti-virus and go online to avg.com or other.

Count Zero · Answer

I also used TROJAN REMOVER and it removed several files and reg entries related to a file called kdwec.exe.  When I restarted my computer still had the problem. I re-ran Trojan Remover after turning off the system restore and the computer seems to working properly.

mike · Answer

what if I already had the free trial of trojan remover and now cannot use it? I dont want to spend 40$ to get it registered. Any way around that?

ghostwhisperer · Answer

hi..i was having the same issues... I tryed everything listed here and most found nothing except malware bytes and super anti spyware.
i gave up as I could no longer even open my avg anti virus and I just took it to a techi its now completely cured he used these two programs
malware bytes
and dr web
thought id share it with you all hope it helps you all too :)

mon3ko · Answer

Thank you morphine, and everyone here involved, who help me fix this issue successfully by simply sharing their knowledge and stories. =)

I was able to use Troyan Remover and SmithFraudCheck and after updating, scanning, cleaning and rebooting my computer is able to once again retrieve Windows Updates, as well any other AV and anti-malware tool! Yeahhh baby!!

Dr Surgeon · Answer

Thanks a lot dudes. I had a rough time fighting this nasty malware.

imzadi · Answer

Any ideas when I cannot get Trojan Remover or anything to install on the infected machine?  

When I read that people had solved this issue using Trojan Remove, I was ecstatic.  I downloaded Trojan Remover on my clean laptop and took it to install it on the infected desktop but nothing happens.  I then tried installing Malwarebytes too just to see if it would install - -  the answer was NO!  


I am so mad at McAfee right now.  Their customer service team sucks.  I cannot believe that I actually pay for their service that failed to protect my machine and they will do nothing to resolve this issue if I don't PAY their virus removal team.

I don't have the OS software to do a reinstall right now and would rather avoid.  I probably need to order it but would love to get this issue solved for now without having to wipe and reinstall.

MrB · Answer

oops I meant try installing it while running in safe mode

razor · Answer

Morphine!!!.You save my day with introduced me with Trojan Remover.Man.you are the man.million thanks.wait..infinite thanks

lia · Answer

yehey! trojan remover worked all right! im so amazed. thaks to you all!

Keifermail · Answer

I am writing to express gratitude for Morphine on this forum for solving my problem. This invasive "virus/malware/painintheass" seems to be diffrent on every machine and it may take several tries to find the solution as I discovered. I also would like to try and figure out where the "bug" came from. I have related below two possible causes. Please others post their stories and let's see if we can come up with the vector.

I acquired this "virus/malware/headache" on 1/27/2009. My last download from Microsoft was a routine updating of Office 2007. I know this because when I tried to use system restore my last save point was the day before I updated Office. I do not believe that Office is the culprit but I would like to know what the last thing others downloaded before they acguired "the bug." A more likely cause would be my habit of occassionally watching videos on Pornhub. This may be TMI, but hey, if we are to figure out where this thing came from I will be the first to admit to frequenting Pornhub as a possibility. If others suspect the same please post your thoughts.

Now about this bug....

 This thing is incredible!

It hijacks every browser on your computer- Explorer, Firefox, Chrome and Safari. When you attempt to Update Windows it sends you to a very good "fake Google page." Every click or search in the fake google page seems to add more malware and directs one to porn sites. i.e. Gay Porn (not that there is anything wrong with that) Just happens that I am straight. I also believe that this is the reason it is worse on some machines than others. I recognized the Google page as fake because I use iGoogle as my home page and there was no button for iGoogle. When I attempted to search is when it became very apparent. It sent you straight to the page it wanted to. It seems that the more you use this fake page the worst the infection becomes.

It doesn't stop at hijacking the browser, it also prevents your Antivirus from updating. I had Trend Micro orginally and went out and bought Kaspersky after being told that it was the best by the IT guys at work This thing shut down Kaspersky's like it owned it. (I had a Disk version of Kaspersky manufactured in Oct 2008. I do believe that had I had Kaspersky before and it was updated, instead of Trend Micro, I would have never caught the bug.) I found this forum yesterday morning Googling "virus hijacks browser and disables updates." 

As Morphine sugested: I downloaded the free Trojan Remover 6.7.5. (It is free for 1st 30 days) Find it here: 

http://www.simplysup.com/tremover/download.html

Then I ran it. It found the offending file and it stated that it needed to be deleted- which I did by clickin OK or something. I thought I had solved the problem and did nothing else other than attempt to update Kaspersky and Windows. Both failed before completing. 

Whoever wrote this "bug" is a genuis, and a sadistic bastard! It is like the last boss fight in good Videogame, you can't kill it with just one weapon. It apprently hides in your RAM and  attaches itself back into the registry. That is why you have to have SmitFraudFixTool. Find it here: 

http://smitfraudfixtool.com/

This program will cost you unfortnately. I already had RegCure but it did not work- its not made to chase bugs. I paid $39.00 for it and can run it on three computers. Anyway, after running the Trojan Remover again and immediately afterwards running SmitFraudFixTool and cleaning out 3156 so called "bad files." I then updated Kaspersky and ran a system scan which finally put the noose on the damn thing for good. This forum was a godsend! 

My computer is now running like a dream! Thank you Morphine for the solution. Please others post their battles with this Monster.

Kenneth · Answer

Wow,thanks!I had this problem for a week,i thought it was normal.Then I use the trojan remover the guy
says and it work ! ^^ thanks

Ken The Golfer · Answer

I have tried every program listed here and still can't get updates or submit data to servers at sites while on line. IE will not connect to the Internet; however, my Windows Vista 64x updates do work as well as a sidebar that updates stock prices. I use Firefox to access the web. I reset the Winsock protocol as it had been corrupted and I verified, reinstalled and reset the contents of the HOSTS file to default. I deleted corrupted registry keys. Checked with my ISP, Time Warner, and they could not offer any solution as I was able to access the net via Firefox. Purchased and ran Smitfixfraud tool, highest rated review, and still the problem continues.  Also downloaded and ran the total deep scan offered on the Microsoft web site. I think this is very clever malware that embeds itself in other applications thus cannot be detected by webroot, virus or other scans. Any solution you can suggest I will try.

However; the only solution I can think of is to return my computer to factory settings, an option available with Visa and reload all my programs from the original disks.

All this started when I downloaded AVG from their official site. Any ideas?

Chetan Bhandari · Answer

Hi dear friend I have a problem to open the antivirus wev site....? what can I do to resolve it.. plz reply soon as soon as posible ...
i m sending u my log detail of Hijeck SW



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:06 PM, on 2/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satelliteaysat_3dsmax9_32server.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\Program Files\Broadband Pacenet\Pacenet Dialer\PaceDial.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe
C:\DOCUME~1\HP\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOCUME~1\HP\LOCALS~1\Temp\Adobelm_Cleanup.0001
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://in.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://in.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://in.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sg.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/en-in?cobrand=hp.msn.com&ocid=HPDHP&pc=HPDTDF
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PestPatrolCL] C:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk142YYIN
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Save with Download Manager... - file://C:\Program Files\J River\Media Center\DMDownload.htm
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D2D9D0D-2DCC-44C8-B724-4896761A41E7}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BA91C73-F101-4CB6-B5CF-03782E734ACF}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{F6A9F0A8-40CF-4F26-B1D7-D7B4FE8CBF78}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF39A6F3-5485-4E39-A466-6CC4508B00B1}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satelliteaysat_3dsmax9_32server.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\system32\WFXSVC.EXE
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
O24 - Desktop Component 0: (no name) - http://img4.orkut.com/js/gen/common044.js

SoulSearcher · Answer

Lmao! I have a few issues! 

1) Is your AVG free, Anti spy ware?? or anti-virus??? 
2) AVG anti-spyware is no longer availble I bought the paid version! So you cant get the updates anymore! I know because I had it, and they tried to upgrade me to Internet Security suite....which is a complete con in my books, I told em where to shove it, because I already have a internet security suite, which I paid for, for 2 years. So lost a year on AVG-anti spyware!

3) Very important if you have a problem NEVER, NEVER, NEVER, D/load anything that is recommended in a forum, You dnt have to be genius to work this out as to why you shouldnt, A) because you cant solve the current problem! and B) because d/loading something else tht is probably absolutley useless to the current problem adds to the frustration of not getting it corrected.

4) This is why.......PEOPLE SHOULD ALWAYS BACK UP THERE COMPUTER!!!

5) If you really are getting a head ache with this, shut down your computer and reboot and all depending on what laptop you have press f11 and try to re-boot back to Manufacture settings, you will lose everything SO BE VERY WARNED! 

This is the quickest and cheapest way of resolving this issue. If you dont want to do that, then consult someone who knows what there talking about.....OPINIONS, opinons, opinions, get the correct information! get ur lazy ass to an independent computer store not a national store and they MAY advise you all depending on how nice you are to them for free.

Greenhorn · Answer

I can't believe it was that easy to fix!!!  My NEW Dell PC became infected with this very aggressive virus or whatever the hell it is.  It appears to have started out as a URL redirector progam so I ran my normal McAfee, Spybot, Ad Aware and stinger...they may not be the best but they have always worked fine for me.  Each time I tried to update these programs, I would get the standard "error" messages...it seemed like every time I tried something it got more severe.  You wouldn't believe how many programs I tried...really like 10!!! and NONE would allow updates except malwarebytes, but it didn't reveal the problem.

FINALLY AFTER READING YOUR LOGS HERE...I downloaded Trojan Remover and it allowed the updates to download.  I pressed the "scan" button and a warning immediately indicated that it had found the TDSS problem and other rootkit problems.  COULD IT BE THAT EASY???  I immediately restarted my PC and tried to update my standard programs...THEY ALL WORK!!! I am now updating everything and running full scans. 

This is my hero:  TROJAN REMOVER

Nanobot29 · Answer

Amazing post by Morphine, on Friday January 2, 2009 05:34:38 AM.......IT TOTALLY CURED THE INFECTION....THANKS A TON!!...U R A GENIUS

......CLEANED MY PC COMPLETELY WITH

TROJAN REMOVER:

www.simplysup.com/tremover/download.html

.....................................................IT TOOK ME A MONTH OF GOOGLING TO HIT THIS THREAD...

THIS IS A NEW KIND OF VIRUS/MALWARE THAT PREVENTS ANY ACCESS TO POPULAR AV UPDATE ...ANY POPULAR ONLINE AV SCAN...DISABLES UPDATES ON MCAF**2009...NORT**2009....AS WELL AS SUPERANTISPYWA** ..EVEN ON FRESH REINSTALL .....BASICALLY ALL POPULAR PROGRAMS...

THE INTERESTING THING IS IF U DO MANAGE TO UPDATE THEM VIA A PEN DRIVE ....NOTHING SHOWS UP IN SCAN..EXCEPT FEW WORTHLESS ADWARE 


.......AS PER TROJAN REMOVER REPORT....

ON MY PC IT ACTUALLY CREATED A LOCKED SERVICES REGISTRY KEY....


C:\WINDOWS\system32\drivers\gaopdxxbldllrm.sys

....THIS FILE WAS IN STEALTH MODE....

IT WAS LOADED BY REGISTRY KEY

HKLM\SYSTEM\CurrentControlSet\Services\gaopdxxbldllrm.sys


....................................


SOLUTION:..(WHAT WORKED IN MY CASE)

RUN TROJAN REMOVER....IT SURPRISINGLY UPDATES SMOOTHLY....THEN REBOOT.....THEREAFTER UPDATE  ON UR SUPERANTISPYWARE SHOULD RUN SMOOTHLY...DO SCAN AGAIN AFTER UPDATE TO REMOVE ANY TRACES.....LASTLY UPDATE UR AV(SHOULD WORK BY NOW) AND SCAN...TO BE DOUBLY SURE....

sourya_4 · Answer

hey it seems am d odd one out....havin d same prob I dwnlded and ran trojan remover....but  it said dat avg is still running n it might not access d mailicious files detected by it...i procceded ran d scan...dltd a few files...but I hav d same problems...pls help me...morphine or anyone.....dis has been torturing me 4 a month...pls help me



in need of help,

ready 2 help fella

ringhio · Answer

hi,

I have the same issue and I have now downloaded the Trojan Remover but I still can't open AVG antivirus.
When running the  scan TR 6.7.5 I get a message that says: "active anti malware program detected. Procees with the scan? Checks indicate that AVG antivirus is running on this PC. If AVG's resdient shield is active then it may prevent Trojan Remover from accessing any file that AVG allready detects as malicious"

Does it mean that I have to disinstall AVG and then re-scan?????

What message should I get from TR 6.7.5 when the virus is found????

ringhio · Answer

Keifermail:


where can we get the Microsoft removal tool for the "kido worm"? Trojan Remover didn't work for me....

Many thanks for your help.

meanstreak · Answer

the trojan remover worked!! thanks guys!!

diddo · Answer

Thanks a lot for the help. I finally got reed of all those pop up windows and was able to update  Windows an my antivirus.Thanks!!!

tcheuchter · Answer

Top Class guys, I too had a nitemare with this thing had chucked everything  I knew at it and it was still infecting reg keys  and  stopping me from updating  any of the good antivirus checkers .... Ran Trojan remover  an was then able to  update spybot  and pc tools av .... All clean an running sweet .... 8 hours later .... I have never seen anything  as sophisticated  as  this was ....  As one of you said some people are being ubber creative in the wrong  manner .... couldnt help being a little impressed at how much trouble it caused.
Anyway job done ... top  thread people ... many thanks

DavidabadÃº · Answer

THANK YOU VERY MUCH FROM BARCELONA. YOU SAVED MY PC... AND MY MENTAL SANITY!!!

"Trojan Remover" did worked for me, and finally I could get rid of this nightmare.

202_d · Answer

paroxism and others.

Been having same problem. What you said made ther most sense; those spyware/malware programs just all stopped being able to update at same time and I had just reloadde XP on fresh HD.

I manually removed a trojan, this must have been a part that I missed; so here is the other half of this (i assume) worm:

In local disc C, my sys kept replicating 'autorun.ini' . To delete it for good, you need to go in the 'prefetch' folder and either remove the 'autorun' file (its the hatching place); or just empty entire 'prefetch' folder.

For any of you having problems still, do this also.

This is intermediate level repair, so if you are not comfortable doing it, get a PC tech to help you.
D

vesperlynd · Answer

I have had the same problems for the last few months and I finally got fed up with more problems occuring. Here are some of the problems I was encountering:

AVG wouldnt update
Windows wouldnt update
volume & network icons were missing from bottom right corner (beside clock)
unable to download spybot search and destroy
when I searched using google and then clicked on a link "jar file" would open or it would "jump" to a different site

I read this thread and just downloaded the Trojan Remover trial version and it fixed all problems! 

Thanks for that, real life saver

budi_28 · Answer

hi...i've the same problem! and no one ur advice can solve my problem....pls...help me

nutcase · Answer

I had the same issues on an xp machine.I downloaded Malwarebytes and ran it.It worked.Updates were turned off,unable to update anything.Even my network connections folder was empty.Malwarebytes did the job.

hub_83 · Answer

thanks a lot morphine!
I used malwarebytes' anti-malware, smitfraudfix, superantispyware, and trojan remover and finally the darn thing is dead and gone. Never in my life I fought a bug so hard.

KANG Ghee Keong · Answer

Took MBAM, and Trojan Killer to remove everything.  Seems like the system is heavily infected during these last 2 days.  Headache cleared.  Thanks everyone for all your input!

tonto · Answer

Trojan Remover rocks!!  I must admit to using a warez version, but as with all good programs that actually work well, Simply Super Software are going to get my money! Well done guys! :-)

Lothowen · Answer

Hay guys just wanted to say a big thankyou for the trojan remover program link that was posted! big help!!!!

i was having some annoying problems on the net and also could not update my antivirus software, I was not able to downlaod spybot or anything similar to it and I was getting redirected all over then net. the worst thing was that everytime I restarted my comp my firewall was getting turned off.......

all sorted now tho so many thanks : )

krislogy · Answer

trojan remover,,,, I love u ummuaah mmuaah :* :* :* :*  !!!

thx morphine, thx others who suggested this tool :)

Marco · Answer

Another success story here: Trojan Remover was the solution to my nightmare. I was fixing a relative's PC that was exhibiting all the symptoms mentioned here: Browser search results redirected, Anti-virus/anti-malware websites blocked, unable to update AVG or any other program, unable to Install any other anti-malware programs, unable to change desktop wallpaper.

Nothing worked, AVG, Spybot, Avira, even PE level virus scans. I was ready for a re-install until I found this forum, and all your suggestions worked! Trojan Remover got rid of the nastiness so I was able to update everything else, run scans, install other progs, runs more scans, and now this PC is back to its old self again.  Thanks all!

Dan · Answer

I have worked on computers for years and fixed many problems dealing with viruses, but this was the worse and put me through more hoops than desirable, BUT your fix worked.  Thank You.

xiyo86 · Answer

Hey everyone!

My computer exhibits only one of the issues mentioned and that is the inability of antivirus programmes to update. I can surf antivirus pages, I do not get redirected anywhere and NONE of the programmes suggested in this forum can find anything. 

Can anybody help?

robotghoul · Answer

i think I have the same thing and i've tried the best answer solution but I still got it... I tried all but spy subract (costs money) and that first one cause I couldn't figure it out and it was in french or something. but everyone else seems to be succeeding with trojan remover and that isn't working for me! please help!

madrao · Answer

Well ive the same problem ...it happnd 2 months ago and trojan remover did the trick ..but destroyed all DNS and IP settings...but now even trojan remover does not ..and beware after the trial period ..try uninstallin trojan remover ..it does not leave the system....! now by anychance is it trojan which has left behind this malware..!im back to square one...none of the updates work or none of the downloads to site pertaining to any site connected to spyware works ...so in truth trojan forced its entry into our systems ..the saviour now has turned villain.....true to its name >>>TROJAN

praveen · Answer

Thank u all who gave me Trojan Remover.
It really solved my problem.

killing hand · Answer

I took the lazy way out, backed up important data, scanned it on my Gentoo system, reformated and reinstalled, no problems from the files I backed up yet. Reformats always work. Just wish I didn't have to.

God forbid I ever run into one of these pests who have the nerve to create said malware, they'll find out just why I bothered to get a concealed carry permit.

Though my suspicions lay around the idea that a lot of people profit from malware and fixing it. Tis why I only ever use freeware period. Nobody should ever pay for antivirus software. Ever.

Of course, there is the random fat greasy pimply 30 year old boy living in his mother's basement trying to get revenge at the world because he is a fail.

Safie · Answer

The trojan tool from https://www.simplysup.com/tremover/download.html  worked a treat - thanks all I was struggling with this for months!!!

AVG-Windows update failure

78 responses

Subscribe To Our Newsletter!