HiJackThis log file

Hi

Those screen shots aren't telling me a lot as I cannot see the full registry key. Catchme is OK as it is a part of the tools we use.

CFScript
Delete the copy of ComboFix you have & download it again:
Link 1
Link 2
Close any open browsers & make sure you Anti-Virus & Anti-Spyware programs are fully disabled.
Open notepad and copy/paste the text in the code box below into it:

File::

c:\windows\fdgg34353edfgdfdf

c:\windows\0535251103110107106.yux

c:\windows\system32\drivers\kgpcpy.cfg

Folder::

c:\windows\fdgg34353edfgdfdf

DDS::

uSearch Page = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com

mDefault_Search_URL = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com

mSearch Page = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

Save this as CFScript.txt, in the same location as ComboFix.exe



Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here & save to your desktop.

• Double-click mbam-setup.exe & follow the prompts to install the program
• At the end, be sure a checkmark is placed next to:
  Update Malwarebytes' Anti-Malware
  Launch Malwarebytes' Anti-Malware
• Then click Finish
• If an update is found, it will download and install the latest version
• Once the program has loaded, select Perform full scan, then click Scan
• When the scan is complete, click OK, then Show Results to view the results
• Be sure that everything is checked, and click Remove Selected
• When completed, a log will open in Notepad. Please copy & paste the log back into your next reply
  Note:
• The log is automatically saved by Malwarebytes' Anti-Malware & can be viewed by clicking the Logs tab

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either & let Malwarebytes' Anti-Malware proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
If you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once & does not need to be reported unless it returns on future reboots.

To post in next reply:
ComboFix log
Malwarebytes' log

Hi:

note: i did all the "what to do if your computer is running slow" but it was still in really good shape from the last time i did those things before i started posting in this board. it is still rather slow starting programs, however, including internet explorer. do you think its ok for me to update to IE 8?

Here are the logs you requested.

Please note that i leave on holiday starting wednesday so i may not reply again until the middle of next week. i much appreciate your help so far and would like you to keep the correspondence open until we have completed it all.

thanks!


Malwarebytes' Anti-Malware 1.41
Database version: 2869
Windows 5.1.2600 Service Pack 3

9/28/2009 9:37:27 PM
mbam-log-2009-09-28 (21-37-27).txt

Scan type: Full Scan (C:\|)
Objects scanned: 177475
Time elapsed: 28 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066732.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066733.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

-----------------------------------------------------------
ComboFix 09-09-28.01 - TMW 09/28/2009 20:44.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.213 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\TMW\Desktop\CFScript.txt

FILE ::
"c:\windows\0535251103110107106.yux"
"c:\windows\fdgg34353edfgdfdf"
"c:\windows\system32\drivers\kgpcpy.cfg"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\0535251103110107106.yux
c:\windows\fdgg34353edfgdfdf
c:\windows\system32\drivers\kgpcpy.cfg

.
((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-23 02:26 . 2009-09-23 02:26 -------- d-----w- c:\program files\ESET
2009-09-18 01:32 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-09-13 17:33 . 2009-09-13 17:33 -------- d-----w- c:\program files\iPhone Configuration Utility
2009-09-13 17:27 . 2009-09-13 17:27 -------- d-----w- c:\program files\iPod
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\program files\iTunes
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 17:18 . 2009-09-13 17:18 -------- d-----w- c:\program files\Bonjour
2009-09-13 17:15 . 2009-09-13 17:17 -------- d-----w- c:\program files\QuickTime
2009-09-11 01:23 . 2009-09-11 01:23 -------- d-----w- c:\program files\AVG
2009-09-11 01:21 . 2009-09-11 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-11 00:48 . 2009-09-11 00:48 -------- d-----w- c:\program files\MSSOAP
2009-09-11 00:47 . 2009-09-11 00:47 -------- d-----w- c:\program files\Webroot
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\TMW\Application Data\Malwarebytes
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-10 01:42 . 2009-09-11 01:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-09-10 01:41 . 2009-09-10 01:41 -------- d-----w- c:\program files\Common Files\iS3
2009-09-10 01:41 . 2009-09-29 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-09-10 01:18 . 2009-09-11 16:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-10 00:06 . 2009-09-10 00:06 -------- d-----w- c:\documents and settings\TMW\Local Settings\Application Data\Mozilla
2009-09-08 23:52 . 2009-09-08 23:52 -------- d-sh--w- c:\documents and settings\TMW\IECompatCache
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-09-03 00:10 . 2009-09-03 00:10 -------- d-----w- c:\program files\Safari

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 23:25 . 2005-03-03 01:35 -------- d-----w- c:\program files\Java
2009-09-18 10:10 . 2008-08-09 14:42 -------- d-----w- c:\program files\MozyHome
2009-09-15 13:10 . 2008-11-28 21:55 -------- d-----w- c:\documents and settings\TMW\Application Data\Apple Computer
2009-09-13 17:27 . 2008-11-28 21:53 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 15:55 . 2005-04-27 02:57 -------- d-----w- c:\program files\Nero
2009-09-11 15:53 . 2009-04-01 00:20 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-09-11 00:42 . 2006-06-08 02:10 -------- d-----w- c:\program files\Trend Micro
2009-09-05 16:19 . 2005-03-10 18:49 73688 -c--a-w- c:\documents and settings\TMW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 01:42 . 2009-04-11 14:27 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-29 01:42 . 2008-11-28 21:53 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-14 12:58 . 2009-09-10 01:19 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-12 01:31 . 2009-05-10 15:36 -------- d-----w- c:\program files\Google
2009-08-12 01:10 . 2009-04-01 00:20 -------- d-----w- c:\program files\McAfee
2009-08-12 01:08 . 2006-05-24 22:50 -------- d-----w- c:\program files\CoffeeCup Software
2009-08-05 09:01 . 2004-08-04 11:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-31 21:23 . 2009-03-14 22:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 2004-08-04 11:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 05:43 . 2004-08-04 11:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2006-06-06 02:46 . 2006-06-06 02:46 88 --sh--r- c:\windows\SYSTEM32\84D9348185.sys
2006-06-06 02:46 . 2006-06-06 02:44 3350 --sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-09-21_23.57.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 02:33 . 2009-09-29 02:33 16384 c:\windows\Temp\Perflib_Perfdata_f4.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
+ 2009-09-29 02:32 . 2009-09-29 02:32 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2009-06-13 15:56 . 2009-06-13 15:56 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2006-10-27 02:49 . 2006-10-27 02:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL
+ 2009-04-04 13:35 . 2009-04-04 13:35 38325760 c:\windows\Installer\fbae641.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-03-03 26112]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"NapsterShell"="c:\program files\Napster\napster.exe" [2008-05-29 323216]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]

c:\documents and settings\TMW\Start Menu\Programs\Startup\
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-5-10 333088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2009-9-14 2891576]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-4-16 118784]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 mozyFilter;mozyFilter;c:\windows\SYSTEM32\DRIVERS\mozy.sys [8/9/2008 8:42 AM 54776]
R2 WUSB54GSVC;WUSB54GSVC;c:\program files\Wireless-G USB Network Adapter\WLService.exe [8/16/2005 6:26 PM 41025]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder

2009-09-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://yahoo.sbc.com/dsl
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\TMW\Application Data\Mozilla\Firefox\Profiles\dwjhl18j.default\
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/sear ... -web_us&p=
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 20:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-09-29 20:53
ComboFix-quarantined-files.txt 2009-09-29 02:52
ComboFix2.txt 2009-09-23 01:32
ComboFix3.txt 2009-09-22 00:03

Pre-Run: 40,354,213,888 bytes free
Post-Run: 40,408,223,744 bytes free

161 --- E O F --- 2009-09-29 02:32

Hi

Please note that i leave on holiday starting wednesday so i may not reply again until the middle of next week. i much appreciate your help so far and would like you to keep the correspondence open until we have completed it all.

Sure no problem at all.
The last ComboFix log looks good. I don't believe the system slowness your experiencing is malware related. When you can, post a new HijackThis log. We'll see if you can stop a few things from running which may help.

inactivity, which has exceeded the time requested,