[Miwakoa]

I managed to pick up Personal Guard 2009. I've tried manually deleting it the best I could, but some things refused to be deleted and others would come back as soon as I deleted the software, and then just reinstall everything else. It's sending me pop-ups, refusing to allow me to install Malwarebytes, and just generally being a hassle. I saw the name appear on the Log, but I don't want to touch anything until I get professional help. So...help?
I'm operating on Windows XP with an eMachines W3115 model.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:58:10 PM, on 10/31/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\winsc.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.h...ys=DTP&M=W3115
F2 - REG:system.ini: Shell=Explorer.exe logon.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [mawoyimus] Rundll32.exe "c:\windows\system32\libupune.dll",a
O4 - HKLM\..\Run: [personalguard] C:\Program Files\Personal Guard 2009\personalguard.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Mozilla Firefox
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: gofizesa.dll c:\windows\system32\libupune.dll
O21 - SSODL: SysNet - {667BA85C-6D49-47D9-B3D4-8DE75947D15F} - C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll
O21 - SSODL: kehumuteb - {99f4744b-3831-4154-a838-65a3c1ddc59d} - c:\windows\system32\libupune.dll
O22 - SharedTaskScheduler: mujuzedij - {99f4744b-3831-4154-a838-65a3c1ddc59d} - c:\windows\system32\libupune.dll
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

--
End of file - 6147 bytes

[NeonFx]

Hello there Welcome to the Tech Support Guy forums.
My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me.

Please note the following:

• The fixes are specific to your problem and should only be used on this machine.
• Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not necessarily mean that the system is completely clean.
• It's often worth reading through these instructions and printing them for ease of reference. I may ask you to boot into Safe Mode where you will be unable to follow my instructions online.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Step 1

Download OTS to your Desktop

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Under Additional Scans check the following:
  
  • Reg - Desktop Components
  • Reg - Disabled MS Config Items
  • Reg - NetSvcs
  • Reg - Shell Spawning
  • Reg - Uninstall List
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EvtViewer (last 10)
  
  
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button

To ensure that I get all the information this log will need to be attached. If it is too large to attach then upload it to Mediafire and post the sharing link.

Step 2

Download RootRepeal from one of the following locations and save it to your desktop:

Link 1
Link 2
Link 3

• Double click to start the program
• Click on the Report tab at the bottom of the program window
• Click the button
• In the Select Scan dialog, check:
  
  • Drivers
  • Files
  • Processes
  • SSDT
  • Stealth Objects
  • Hidden Services
  • Shadow SSDT
  
  
• Click the OK button
• In the next dialog, select all drives showing
• Click OK to start the scan

  Note: The scan can take some time. DO NOT run any other programs while the scan is running
  

• When the scan is complete, click the button and save the report to your Desktop as RootRepeal.txt
• Go to File, then Exit to close the program

If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.

[Miwakoa]

Well I did everything you said to do. Hopefully this gives you the information you need.

[NeonFx]

Alright. Let's do the following:

STEP 1

Run OTS

• Under the Paste Fix Here box on the right, paste in the following

[Unregister Dlls]
[Processes - Safe List]
YY -> personalguard.exe -> C:\Program Files\Personal Guard 2009\personalguard.exe
YY -> winsc.exe -> C:\WINDOWS\system32\winsc.exe
[Modules - Safe List]
YY -> pigopimu.dll -> C:\WINDOWS\system32\pigopimu.dll
YY -> dejegima.dll -> C:\WINDOWS\system32\dejegima.dll
[Registry - Safe List]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "mawoyimus" -> C:\WINDOWS\System32\dejegima.DLL [Rundll32.exe "c:\windows\system32\dejegima.dll",a]
YY -> "personalguard" -> C:\Program Files\Personal Guard 2009\personalguard.exe [C:\Program Files\Personal Guard 2009\personalguard.exe]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YY -> c:\windows\system32\dejegima.dll -> C:\WINDOWS\system32\dejegima.dll
YY -> pigopimu.dll -> C:\WINDOWS\System32\pigopimu.dll
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
YY -> logon.exe -> C:\WINDOWS\System32\logon.exe
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{99f4744b-3831-4154-a838-65a3c1ddc59d}" [HKLM] -> Reg Error: Key error. [kehumuteb]
YY -> "{667BA85C-6D49-47D9-B3D4-8DE75947D15F}" [HKLM] -> C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll [SysNet]
YY -> "{b887573a-08f6-40ca-a4eb-77b0416853a9}" [HKLM] -> C:\WINDOWS\system32\dejegima.dll [wesehalaj]
< SharedTaskScheduler [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
YY -> "{b887573a-08f6-40ca-a4eb-77b0416853a9}" [HKLM] -> C:\WINDOWS\system32\dejegima.dll [mujuzedij]
[Registry - Additional Scans - Safe List]
< Uninstall List [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
YN -> Personal Guard 2009 -> Personal Guard 2009
[Files/Folders - Created Within 30 Days]
NY ->  C:\Program Files\Personal Guard 2009 -> C:\Program Files\Personal Guard 2009
NY -> Microsoft AData -> C:\Documents and Settings\All Users\Microsoft AData
[Files/Folders - Modified Within 30 Days]
NY -> rayufiyu -> C:\WINDOWS\System32\rayufiyu
NY -> mttbdppv.job -> C:\WINDOWS\tasks\mttbdppv.job
NY -> logfile -> C:\logfile
NY -> regred.exe -> C:\WINDOWS\regred.exe
NY -> spoov.exe -> C:\WINDOWS\spoov.exe
NY -> certsystem.exe -> C:\WINDOWS\certsystem.exe
NY -> usexplorer.exe -> C:\WINDOWS\usexplorer.exe
NY -> securits.com -> C:\WINDOWS\securits.com
NY -> microsoftdef.dll -> C:\WINDOWS\microsoftdef.dll
NY -> winsc.exe -> C:\WINDOWS\System32\winsc.exe
NY -> logon.exe -> C:\WINDOWS\System32\logon.exe
[Files - No Company Name]
NY -> mttbdppv.job -> C:\WINDOWS\tasks\mttbdppv.job
NY -> winsc.exe -> C:\WINDOWS\System32\winsc.exe
NY -> spoov.exe -> C:\WINDOWS\spoov.exe
NY -> certsystem.exe -> C:\WINDOWS\certsystem.exe
NY -> regred.exe -> C:\WINDOWS\regred.exe
NY -> usexplorer.exe -> C:\WINDOWS\usexplorer.exe
NY -> securits.com -> C:\WINDOWS\securits.com
NY -> microsoftdef.dll -> C:\WINDOWS\microsoftdef.dll
NY -> logon.exe -> C:\WINDOWS\System32\logon.exe
NY -> pigopimu.dll -> C:\WINDOWS\System32\pigopimu.dll
NY -> jobavito.dll -> C:\WINDOWS\System32\jobavito.dll
NY -> jehodini.dll -> C:\WINDOWS\System32\jehodini.dll
NY -> dejegima.dll -> C:\WINDOWS\System32\dejegima.dll
NY -> sumonibe.dll -> C:\WINDOWS\System32\sumonibe.dll
NY -> kakinahu.dll -> C:\WINDOWS\System32\kakinahu.dll
NY -> rotawugo.dll -> C:\WINDOWS\System32\rotawugo.dll
NY -> hurasivi.dll -> C:\WINDOWS\System32\hurasivi.dll
[File - Lop Check]
NY ->  ISP signup reminder 1.job -> C:\WINDOWS\Tasks\ISP signup reminder 1.job
NY ->  mttbdppv.job -> C:\WINDOWS\Tasks\mttbdppv.job
[Custom Items]
:files
C:\Documents and Settings\All Users\Microsoft AData
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_Dlls"=""
:end
[Empty Temp Folders]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• This will create a log in C:\_OTS\MovedFiles\<date>_<time>.txt where date and time are those of when the fix was run. Open it from there if it does not appear automatically on reboot. Please copy and paste the contents of that file here.

STEP 2

Run OTS again and click on the Quick Scan button at the top. Copy and Paste the results of this scan in your next reply.

[Miwakoa]

Well, the personal guard thing doesn't seem to be showing up, though I am still getting pop-up advertisements. Any way to stop those?
Also, is the OTS thing supposed to say it encountered an error and needed to close? It did that half-way into the scan, but kept running until it finished. However, it wouldn't reboot on its own, I had to do that manually. I just wanted to note these occurrences in case they were significant.
Oh and I was wondering if there was any way to get my bookmarked web pages and homepage back. Do I just have to go put them all back on again, or is the information still there and it'll come back?


All Processes Killed
[Processes - Safe List]
No active process named personalguard.exe was found!
C:\Program Files\Personal Guard 2009\personalguard.exe moved successfully.
No active process named winsc.exe was found!
C:\WINDOWS\system32\winsc.exe moved successfully.
[Modules - Safe List]
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pigopimu.dll
Releasing module C:\WINDOWS\system32\pigopimu.dll
C:\WINDOWS\system32\pigopimu.dll moved successfully.
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\mawoyimus deleted successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\dejegima.DLL
C:\WINDOWS\System32\dejegima.DLL moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\personalg uard deleted successfully.
File C:\Program Files\Personal Guard 2009\personalguard.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\dejegima.dll deleted successfully.
File C:\WINDOWS\system32\dejegima.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dllsigopimu.dll deleted successfully.
File C:\WINDOWS\System32\pigopimu.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:logon.exe deleted successfully.
File move failed. C:\WINDOWS\System32\logon.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad\\kehumuteb deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99f4744b-3831-4154-a838-65a3c1ddc59d}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad\\SysNet deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{667BA85C-6D49-47D9-B3D4-8DE75947D15F}\ deleted successfully.
DllUnregisterServer procedure not found in C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll
C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad\\wesehalaj not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b887573a-08f6-40ca-a4eb-77b0416853a9}\ not found.
File C:\WINDOWS\system32\dejegima.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Share dTaskScheduler\\{b887573a-08f6-40ca-a4eb-77b0416853a9} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b887573a-08f6-40ca-a4eb-77b0416853a9}\ not found.
File C:\WINDOWS\system32\dejegima.dll not found.
[Registry - Additional Scans - Safe List]
[Files/Folders - Created Within 30 Days]
C:\Program Files\Personal Guard 2009\q folder moved successfully.
C:\Program Files\Personal Guard 2009 folder moved successfully.
C:\Documents and Settings\All Users\Microsoft AData folder moved successfully.
[Files/Folders - Modified Within 30 Days]
C:\WINDOWS\System32\rayufiyu moved successfully.
File C:\WINDOWS\tasks\mttbdppv.job not found!
C:\logfile moved successfully.
C:\WINDOWS\regred.exe moved successfully.
C:\WINDOWS\spoov.exe moved successfully.
C:\WINDOWS\certsystem.exe moved successfully.
C:\WINDOWS\usexplorer.exe moved successfully.
C:\WINDOWS\securits.com moved successfully.
LoadLibrary failed for C:\WINDOWS\microsoftdef.dll
C:\WINDOWS\microsoftdef.dll moved successfully.
File C:\WINDOWS\System32\winsc.exe not found!
File move failed. C:\WINDOWS\System32\logon.exe scheduled to be moved on reboot.
[Files - No Company Name]
File C:\WINDOWS\tasks\mttbdppv.job not found!
File C:\WINDOWS\System32\winsc.exe not found!
File C:\WINDOWS\spoov.exe not found!
File C:\WINDOWS\certsystem.exe not found!
File C:\WINDOWS\regred.exe not found!
File C:\WINDOWS\usexplorer.exe not found!
File C:\WINDOWS\securits.com not found!
File C:\WINDOWS\microsoftdef.dll not found!
File move failed. C:\WINDOWS\System32\logon.exe scheduled to be moved on reboot.
File C:\WINDOWS\System32\pigopimu.dll not found!
DllUnregisterServer procedure not found in C:\WINDOWS\System32\jobavito.dll
C:\WINDOWS\System32\jobavito.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\jehodini.dll
C:\WINDOWS\System32\jehodini.dll moved successfully.
File C:\WINDOWS\System32\dejegima.dll not found!
DllUnregisterServer procedure not found in C:\WINDOWS\System32\sumonibe.dll
C:\WINDOWS\System32\sumonibe.dll moved successfully.
File C:\WINDOWS\System32\kakinahu.dll not found!
DllUnregisterServer procedure not found in C:\WINDOWS\System32\rotawugo.dll
C:\WINDOWS\System32\rotawugo.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\hurasivi.dll
C:\WINDOWS\System32\hurasivi.dll moved successfully.
[File - Lop Check]
C:\WINDOWS\Tasks\ISP signup reminder 1.job moved successfully.
File C:\WINDOWS\Tasks\mttbdppv.job not found!
[Custom Items]
========== FILES ==========
File/Folder C:\Documents and Settings\All Users\Microsoft AData not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_Dlls"|"" /E : value set successfully!
[Empty Temp Folders]


User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 65716 bytes
->Temporary Internet Files folder emptied: 2936317 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33036 bytes

User: Owner
->Temp folder emptied: 475063828 bytes
->Temporary Internet Files folder emptied: 27920797 bytes
->Java cache emptied: 14883267 bytes
->FireFox cache emptied: 65276083 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 61345082 bytes
RecycleBin emptied: 2321 bytes

Total Files Cleaned = 617.59 mb

< End of fix log >
OTS by OldTimer - Version 3.1.2.0 fix logfile created on 11022009_072046

Files\Folders moved on Reboot...
C:\WINDOWS\System32\logon.exe moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\34AF6D.dmp moved successfully.

Registry entries deleted on Reboot...

[NeonFx]

I'm not sure what removed the bookmarks, but once they're removed they're gone.

The infection doesn't want to let go yet. Let's try this now:

STEP 1

Run OTS

• Under the Paste Fix Here box on the right, paste in the following

[Unregister Dlls]
[Modules - Safe List]
YY -> voyuvofe.dll -> C:\WINDOWS\system32\voyuvofe.dll
[Registry - Safe List]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "mawoyimus" -> C:\WINDOWS\System32\voyuvofe.DLL [Rundll32.exe "c:\windows\system32\voyuvofe.dll",a]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YY -> c:\windows\system32\voyuvofe.dll -> C:\WINDOWS\system32\voyuvofe.dll
YY -> c:\windows\system32\dejegima.dll -> C:\WINDOWS\System32\dejegima.dll
YN -> pigopimu.dll -> 
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YY -> "{b99878c5-4132-4217-9b45-bd5df01873c0}" [HKLM] -> C:\WINDOWS\system32\voyuvofe.dll [nobugofoz]
< SharedTaskScheduler [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
YY -> "{b99878c5-4132-4217-9b45-bd5df01873c0}" [HKLM] -> C:\WINDOWS\system32\voyuvofe.dll [jugezatag]
[Files/Folders - Modified Within 14 Days]
NY -> logfile -> C:\logfile
NY -> vowowono.dll -> C:\WINDOWS\System32\vowowono.dll
NY -> fcnmovqi.job -> C:\WINDOWS\tasks\fcnmovqi.job
NY -> rayufiyu -> C:\WINDOWS\System32\rayufiyu
[Files - No Company Name]
NY -> logfile -> C:\logfile
NY -> vowowono.dll -> C:\WINDOWS\System32\vowowono.dll
NY -> fcnmovqi.job -> C:\WINDOWS\tasks\fcnmovqi.job
NY -> yevilido.dll -> C:\WINDOWS\System32\yevilido.dll
NY -> pafikiwu.dll -> C:\WINDOWS\System32\pafikiwu.dll
NY -> bikurifo.dll -> C:\WINDOWS\System32\bikurifo.dll
NY -> voyuvofe.dll -> C:\WINDOWS\System32\voyuvofe.dll
NY -> radisezo.dll -> C:\WINDOWS\System32\radisezo.dll
[File - Lop Check]
NY ->  fcnmovqi.job -> C:\WINDOWS\Tasks\fcnmovqi.job
[Custom Items]
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
:end
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• This will create a log in C:\_OTS\MovedFiles\<date>_<time>.txt where date and time are those of when the fix was run. Open it from there if it does not appear automatically on reboot. Please copy and paste the contents of that file here.

STEP 2

Run OTS again and click on the Quick Scan button at the top. Attach the results of this scan in your next reply.

[Miwakoa]

Well that's unfortunate about the bookmarks I guess. Can I still get my homepage back?
Anyway, the process encountered two errors that I wanted to note in case there was any significance.
A "Bad Image" error for C:/windows/system32/bikurifo.dll not being a valid windows image.
And A RunDLL error loading C:/windows/system32/voyuvofe.dll that couldn't be found. This error in particular popped up after rebooting and stopped the log from the fix from displaying on its own.

Here's the log after the fix and the OTS quick scan is attached:

[Modules - Safe List]
DllUnregisterServer procedure not found in C:\WINDOWS\system32\voyuvofe.dll
Releasing module c:\windows\system32\voyuvofe.dll
C:\WINDOWS\system32\voyuvofe.dll moved successfully.
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\mawoyimus deleted successfully.
File C:\WINDOWS\System32\voyuvofe.DLL not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\voyuvofe.dll deleted successfully.
File C:\WINDOWS\system32\voyuvofe.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\dejegima.dll deleted successfully.
File C:\WINDOWS\System32\dejegima.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dllsigopimu.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceOb jectDelayLoad\\nobugofoz deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b99878c5-4132-4217-9b45-bd5df01873c0}\ deleted successfully.
File C:\WINDOWS\system32\voyuvofe.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Share dTaskScheduler\\{b99878c5-4132-4217-9b45-bd5df01873c0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b99878c5-4132-4217-9b45-bd5df01873c0}\ deleted successfully.
File C:\WINDOWS\system32\voyuvofe.dll not found.
[Files/Folders - Modified Within 14 Days]
C:\logfile moved successfully.
LoadLibrary failed for C:\WINDOWS\System32\vowowono.dll
C:\WINDOWS\System32\vowowono.dll moved successfully.
C:\WINDOWS\tasks\fcnmovqi.job moved successfully.
C:\WINDOWS\System32\rayufiyu moved successfully.
[Files - No Company Name]
File C:\logfile not found!
File C:\WINDOWS\System32\vowowono.dll not found!
File C:\WINDOWS\tasks\fcnmovqi.job not found!
DllUnregisterServer procedure not found in C:\WINDOWS\System32\yevilido.dll
C:\WINDOWS\System32\yevilido.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\pafikiwu.dll
C:\WINDOWS\System32\pafikiwu.dll moved successfully.
LoadLibrary failed for C:\WINDOWS\System32\bikurifo.dll
C:\WINDOWS\System32\bikurifo.dll moved successfully.
File C:\WINDOWS\System32\voyuvofe.dll not found!
DllUnregisterServer procedure not found in C:\WINDOWS\System32\radisezo.dll
C:\WINDOWS\System32\radisezo.dll moved successfully.
[File - Lop Check]
File C:\WINDOWS\Tasks\fcnmovqi.job not found!
[Custom Items]
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
< End of fix log >
OTS by OldTimer - Version 3.1.2.0 fix logfile created on 11022009_211447

[NeonFx]

It seems we finally killed it. We didn't have any luck the first time because the infection had a chance to spread. Let's get rid of some pieces left over of the dead beast and run a malwarebytes scan.

To set the home page in Firefox just go to Tools > Options.

STEP 1

Run OTS

• Under the Paste Fix Here box on the right, paste in the following

[Unregister Dlls]
[Registry - Safe List]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YY -> c:\windows\system32\voyuvofe.dll -> C:\WINDOWS\System32\voyuvofe.dll
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
YN -> "{b99878c5-4132-4217-9b45-bd5df01873c0}" [HKLM] -> C:\WINDOWS\System32\voyuvofe.dll [nobugofoz]
< SharedTaskScheduler [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
YN -> "{b99878c5-4132-4217-9b45-bd5df01873c0}" [HKLM] -> C:\WINDOWS\System32\voyuvofe.dll [jugezatag]
[Files/Folders - Modified Within 14 Days]
NY -> logfile -> C:\logfile
[ClearAllRestorePoints]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• This will create a log in C:\_OTS\MovedFiles\<date>_<time>.txt where date and time are those of when the fix was run. Open it from there if it does not appear automatically on reboot. Please copy and paste or attach the contents of that file here.

STEP 2

Run MalwareBytes AntiMalware

• Update it by clicking on the update tab and then on the button.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan. Scan all of your harddrives.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

STEP 3


Run OTS again and click on the Quick Scan button at the top. Attach the results of this scan in your next reply.

[Miwakoa]

Yay malware bytes works again!
Here's the info you asked for.

[NeonFx]

Those look good. Do you have the results from the malwarebytes full scan? You can get them by clicking on the "logs" tab.

[Miwakoa]

Sorry for the late reply!
Here's the log:

Malwarebytes' Anti-Malware 1.41
Database version: 3092
Windows 5.1.2600 Service Pack 2

11/3/2009 8:31:50 AM
mbam-log-2009-11-03 (08-31-50).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Objects scanned: 164959
Time elapsed: 40 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 15

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Personal Guard 2009 (Rogue.PersonalGuard2009) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mawoyimus (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\NJBDKCX7\load-full[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\NJBDKCX7\load-full[2].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\NJBDKCX7\load-full[3].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_Documents and Settings\All Users\Microsoft AData\sysnet.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_Program Files\Personal Guard 2009\personalguard.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_Program Files\Personal Guard 2009\uninstalls.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\jehodini.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\jobavito.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\logon.exe (Worm.Emold) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\pigopimu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\rotawugo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_072046\C_WINDOWS\system32\winsc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_211447\C_WINDOWS\system32\pafikiwu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_211447\C_WINDOWS\system32\radisezo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTS\MovedFiles\11022009_211447\C_WINDOWS\system32\voyuvofe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

[NeonFx]

Good Let's run an online scan to be absolutely sure you're clean. This will take a while but it's well worth it as it will find things all other scanners will miss.

STEP 1

Before we do, I need you to update Internet Explorer to IE8. Even if you don't use it, we need to have it updated as its components are deeply connected with Windows itself.

Please go here to download the installer:

http://www.microsoft.com/windows/internet-explorer/

STEP 2

The online scanner uses Java, so I will need you to download and install the latest version for that.

Please go here to download the installer:

http://java.com/en/download/index.jsp


STEP 3

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.



2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.


The program will then begin downloading and installing and will also update the database.


Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
  
  
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

[Miwakoa]

Here it is.

[NeonFx]

Great It found the things we already took care of and one thing that isn't dangerous.

How's the computer running?

[Miwakoa]

Running just fine like the problem never even happened.
So is this everything that needed to be done?