Antivirus 360/Trojan vundo/Malware.trace infection

Hello,

I am infected with a nasty trojan. I have tried to clear it up with all kinds of removal tools with no success! I have tried spybot, ad-aware, my intivirus..bitdefender, and malawarebytes. Malawarebytes seems to be the only program picking it up know and says I have trojan.vundo and malaware.trace in my computer. When I press the fix button it says it has quarantined and removed the infection. When I go back to use firefox, or explorer, the pop ups keeps appearing and eventually antivirus 360 comes up again as well. Nothing has worked please help!!!!

Here are my logs.


DDS (Version 1.1.0) - NTFSx86
Run by Daniel Beam at 12:01:41.09 on Sat 12/27/2008
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1534.939 [GMT -7:00]

AV: Bitdefender Antivirus *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -kbdx
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Digital Media Reader\shwicon2k.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Daniel Beam\Desktop\dds.com
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = www.msn.com/
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Google plugin: {f6e0ef5f-5f03-43f9-8e02-bbaaa95eaa9c} - nods32.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2008\IEToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2008\IEShow.exe"
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2008\bdagent.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunKist] c:\program files\digital media reader\shwicon2k.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter3.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: myozth.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\daniel~1\applic~1\mozilla\firefox\profiles\qmxp7ofl.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R3 HSFHWVIA;HSFHWVIA;c:\windows\system32\drivers\HSFHWVIA.sys [2004-6-3 193152]
S3 CEUSBAUD;DigiTech USB MIDI Driver;c:\windows\system32\drivers\CEUSBAUD.sys [2003-11-1 17920]
S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2008-6-9 32512]

=============== Created Last 30 ================

2008-12-27 09:20 <DIR> --d----- c:\program files\Trend Micro
2008-12-26 19:53 1 a------- c:\windows\system32\tb.dr
2008-12-26 19:53 1 a------- c:\windows\system32\rc.dat
2008-12-26 19:53 1 a------- c:\windows\system32\ps1.dat
2008-12-26 19:53 1 a------- c:\windows\system32\cs.dat
2008-12-26 19:53 1 a------- c:\windows\system32\cookie1.dat
2008-12-26 19:53 1 a------- c:\windows\system32\bb1.dat
2008-12-26 19:21 46,592 a------- c:\windows\system32\nods32.dll
2008-12-26 19:21 1 a------- c:\windows\system32\za.dat
2008-12-26 18:27 250 a------- c:\windows\gmer.ini
2008-12-26 14:04 <DIR> --d----- c:\program files\Enigma Software Group
2008-12-25 07:44 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-25 07:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-25 01:11 552 a------- c:\windows\system32\d3d8caps.dat
2008-12-24 15:19 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-24 14:51 37 a------- c:\docume~1\alluse~1\applic~1\atconf.dat
2008-12-24 09:31 <DIR> --d----- c:\docume~1\daniel~1\applic~1\Malwarebytes
2008-12-24 09:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-12-24 09:11 <DIR> --d----- C:\VundoFix Backups
2008-12-23 22:59 <DIR> --d----- c:\windows\ERUNT
2008-12-23 22:44 <DIR> --d----- C:\SDFix
2008-12-23 17:44 130,048 -------- c:\windows\system32\myozth.dll
2008-12-23 17:44 130,048 a------- c:\windows\system32\coqbvonh.dll
2008-12-23 17:34 41,472 a------- c:\windows\Uzibitaciw.dll
2008-12-23 17:34 41,472 a------- C:\udou.exe
2008-12-18 17:03 244 a---h--- C:\sqmnoopt08.sqm
2008-12-18 17:03 232 a---h--- C:\sqmdata08.sqm
2008-12-08 16:26 2,570,520 a------- c:\windows\system32\drivers\LV302V32.SYS
2008-12-08 16:24 627,864 a------- c:\windows\system32\drivers\lvrs.sys
2008-12-08 16:24 195,096 a------- c:\windows\system32\lvci11801048.dll
2008-12-04 00:18 <DIR> --d----- c:\docume~1\daniel~1\applic~1\LimeWire

==================== Find3M ====================

2008-12-27 10:02 81,984 a------- c:\windows\system32\bdod.bin
2008-10-23 05:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-17 23:24 55,280 a---h--- c:\windows\system32\mlfcache.dat
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-16 13:38 826,368 a------- c:\windows\system32\wininet.dll
2008-10-03 03:02 247,326 a------- c:\windows\system32\strmdll.dll
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll
2008-05-07 21:21 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008050720080508\index.dat

============= FINISH: 12:02:40.28 ===============

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

Upon completing the steps below a staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.com
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results, click no to the Optional_Scan
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

This may seem repetitive, but we need to see the current status of your system, please.
Please Hold on it may take us a day or so to get back with you.

R,
K

My issue has been solved. Malwarebytes did eventually delete the remaining infections. I just kept updating it every day and eventually it got rid of it.
Thanks for responding.

If you find other problems please start a new topic.

Thanks for informing us and good luck.

This thread is closed.