help with rouge.ddddddefragmentor

Yes, a virus could effect only one user account. If you want us to check for malware, please do the following:

READ & RUN ME FIRST. Malware Removal Guide

 

The below is quoted from the beginning of the READ & RUN ME

Thus, you need to keep going.

 

Please read this:
How to attach items to your post or view How to Attach Items the Video.

We still need the following logs from doing the Read and Run First instructions:
MBAM
ComboFix
RootRepeal ( if it runs )
C:\MGLogs.zip from running the C:\MGTools.exe

 

Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

• Right click the Command Prompt entry and select Run As Administrator.
  
  • It is critical that you run it this way.
  
  
• If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.
• Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

 

I am just wanting to be sure you are malware free, so let's see if you can run this:

Download OTL by Old Timer. and save it to your Desktop.

* Double click on OTL.exe to run it.
* Under Output, ensure that Minimal Output is selected.
* Under Extra Registry section, select Use SafeList.
* Click the Scan All Users checkbox.
* Click on Run Scan at the top left hand corner.
* When done, two Notepad files will open.
o OTListIt.txt <-- Will be opened
o Extra.txt <-- Will be minimized
* Please post the contents of these 2 Notepad files in your next reply.

I will be checking back later but need to log off for now. Tell me also what issues you are having, if any.

 

Let's see if you can produce a HJT log. Please go to C:\MGTools\analyse.exe and double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Now use windows explorer and see if you can find and delete:
C:\Users\Angie\AppData\Local\Pnacalev.dat
C:\Users\Angie\AppData\Local\Ugufagif.bin
C:\ProgramData\49rXfxgl0Afmo

Attach the HJT log.

 

You do have a lot of things loading at startup. You may wish to use:

Startup_CPL

You have McAfee, Panda Process Protection, Teatimer, Spyware Doctor, and Threatfire all running which is part of your slowness issue. You need to uninstall Spyware Doctor ( unless it is a paid for version ) as well as Threatfire and Panda Process Protection!!

Please Disable Spybot's TeaTimer --> Should have been done as per the R&R instructions!

* Run Spybot and click Mode
* Select Advanced Mode.
* Then click Tools and select Resident.
* Now in the right window pane, uncheck TeaTimer.
* Also while this is open, in the left column now select IE Tweaks
* and then in the right pane make sure all the Miscellaneous locks are unchecked.
* Now quit Spybot!


Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\ProgramData\49rXfxgl0Afmo.exe
C:\Users\Angie\AppData\Local\oxoyoyulid.dll
C:\Users\Angie\AppData\Local\dilenSDI.dll
C:\ProgramData\xVrkkhEDTaOX.exe

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

You have all of this running at start up:
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [PINGER] C:\TOSHIBA\IVP\ISM\pinger.exe /run
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SetupType] Portable
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HPWireless] "C:\Program Files\HP Wireless Adapter\HPWLAN.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [TOSCDSPD] TOSCDSPD.EXE (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [Easy Dock] C:\Users\Angie\Documents\RCA easyRip\EZDock.exe (User 'Angie')
O4 - HKUS\S-1-5-21-2334676359-2960982074-1220929701-1001\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Angie')
O4 - S-1-5-21-2334676359-2960982074-1220929701-1001 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Angie')
O4 - S-1-5-21-2334676359-2960982074-1220929701-1001 Startup: RCA Detective.lnk = C:\Users\Angie\Documents\RCA Detective\RCADetective.exe (User 'Angie')
O4 - S-1-5-21-2334676359-2960982074-1220929701-1001 User Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Angie')
O4 - S-1-5-21-2334676359-2960982074-1220929701-1001 User Startup: RCA Detective.lnk = C:\Users\Angie\Documents\RCA Detective\RCADetective.exe (User 'Angie')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Bluetooth.lnk.disabled
O4 - Global Startup: connection manager.lnk = ?

Once you disable McAfee, uninstall Panda Process Protection, Teatimer, Spyware Doctor, and Threatfire, then try running the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

 

I am not seeing Threatfire in your add/remove items. If it is not in your program list, dont worry about it.

Use windows explorer to find and delete:
C:\ProgramData\gFdCb06504
Also delete this folder:
C:\Program Files\Common Files\Panda Software

Open notepad and copy and paste the following text in the quote box into the window:

Save this as fix.bat on your desktop.
Choose to save as all files.
Doubleclick fix.bat and let the program run.
A small black dos window will flash, this is normal.

Now tell me what issue remain, if any.

 

You are quite welcome!!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
     
     
   
   
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
   
   
10. After doing the above, you should work thru the below link:
    
    • How to Protect yourself from malware!
    
    

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook