I am running xp home edition. I have AVG free, Windows Defender, Spybot S&D, Malwarebytes. I have disabled system restore. AVG, mbam, and Spybot S&D have scanned every day for over a week and continually discover new infections. There are many tracking cookies, but the many trojans that come up are what worry me.
Here are some of the infections that have come up in the many logs and scan results I have looked through.
Win32/Heur (in various locations, but mostly in system 32 files), Trojan Horse Dowloader.Agent.AULY, Trojan Horse BackDoor.Generic10.ACET, Virtumonde, Trojan:Win32/Alureon.BI, TrojanSpy:Win32/Festeal.C, Trojan.Agent, Trojan.Vundo.H. Many registry keys have been affected also.
AVG did not actually remove some of the infections, but said: "object is in whitelist." Between the security programs, they removed some threats, but then the next day more of the same or similar threats are again detected. When the computer has been running for a while (a few hours or more), the internet connection does not work (even through the connection is physically there and working), Many applications will not open and they cite some error or say that there is not sufficient information to open it or the files no longer exist. When i restart, all of the above will work again. Windows firewall (which I normally have on) says: "Windows Firewall is turned off. Your network administrator is using Group Policy to control these settings." I am unable to turn it on. In the Task Manager, I constantly have many processes running (55-60 or more, even when I have no programs running). There are many svchost.exe and iexplorer processes running (even when IE is not open). CPU is often at 100%, while no programs are running. I would like to avoid formatting my disk, but am prepared to do so, if necessary.
If there is any other information I can give you that will help, please let me know. Here is the dds log that I ran a little bit ago today.
Thank you,
Rebekah
---------------------
DDS (Ver_09-02-01.01) - NTFSx86
Run by Owner at 12:44:54.67 on Wed 02/25/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.399 [GMT -8:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Micro Innovations\Wireless Keyboard and Laser Mouse\mouse32a.exe
C:\Program Files\Micro Innovations\Wireless Keyboard and Laser Mouse\kbdap32a.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
svchost.exe C:\WINDOWS\TEMP\VRT3.tmp
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Owner\Desktop\dds.scr
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.msn.com
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.msn.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [VnrPack24] "c:\program files\vnrpack\VnrPack24.exe"
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [FLMOFFICE4DMOUSE] c:\program files\micro innovations\wireless keyboard and laser mouse\mouse32a.exe
mRun: [OFFICEKB] c:\program files\micro innovations\wireless keyboard and laser mouse\kbdap32a.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
dRun: [reader_s] c:\windows\system32\config\systemprofile\reader_s.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by115fd.bay115.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1161324923015
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} - hxxp://sonecam1.mine.nu/bl_camera.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://sagesoftwareevents.webex.com/client/T25L/webex/ieatgpc.cab
DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - hxxp://by115fd.bay115.hotmail.msn.com/activex/HMAtchmt.ocx
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\qoMfdCsQ
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\kr4a8wsg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-5 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-5 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-5 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-5 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-5 298264]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S0 anqinapk;anqinapk;c:\windows\system32\drivers\rpnzeaxn.sys --> c:\windows\system32\drivers\rpnzeaxn.sys [?]
S0 vogxvvlw;vogxvvlw;c:\windows\system32\drivers\htdprbkj.sys --> c:\windows\system32\drivers\htdprbkj.sys [?]
SUnknown euroaova;euroaova; [x]
UnknownUnknown restore;restore; [x]
=============== Created Last 30 ================
2009-02-25 12:10 578,560 a------- c:\windows\system32\agxvr
2009-02-25 12:09 105,984 a------- c:\windows\system32\7.tmp
2009-02-25 12:09 1 a------- c:\windows\system32\5.tmp
2009-02-25 12:09 0 a------- c:\windows\system32\6.tmp
2009-02-25 12:09 124 a------- c:\windows\system32\4.tmp
2009-02-25 08:02 244 a---h--- C:\sqmnoopt02.sqm
2009-02-25 08:02 232 a---h--- C:\sqmdata02.sqm
2009-02-25 07:59 244 a---h--- C:\sqmnoopt01.sqm
2009-02-25 07:59 232 a---h--- C:\sqmdata01.sqm
2009-02-25 07:54 244 a---h--- C:\sqmnoopt00.sqm
2009-02-25 07:54 232 a---h--- C:\sqmdata00.sqm
2009-02-25 07:51 105,984 a------- c:\windows\system32\azton.mt
2009-02-24 23:30 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-24 23:22 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-24 06:41 401,720 a------- c:\program files\HiJackThis.exe
2009-02-23 21:47 262,144 a------- c:\windows\system32\nvtpm32.dll
2009-02-23 19:54 578,560 a------- c:\windows\system32\fmjwwf
2009-02-23 12:47 0 a------- c:\windows\mqcd.dbt
2009-02-23 12:46 32,768 a------- c:\windows\system32\odjan.wa
2009-02-23 12:46 28,672 a------- c:\windows\system32\kdoqmn.sr
2009-02-23 12:46 32,768 a------- c:\windows\system32\kei1w.an
2009-02-23 12:46 28,672 a------- c:\windows\system32\doqkm.zt
2009-02-23 12:46 77,312 a------- c:\windows\system32\rkoq.pxf
2009-02-23 12:43 578,560 ac------ c:\windows\system32\dllcache\user32.dll
2009-02-21 18:41 0 a------- c:\windows\system32\21.tmp
2009-02-21 18:41 168 a------- c:\windows\system32\15.tmp
2009-02-21 15:10 0 a------- c:\windows\system32\22.tmp
2009-02-21 15:10 168 a------- c:\windows\system32\1E.tmp
2009-02-21 14:24 0 a------- c:\windows\system32\1C.tmp
2009-02-21 14:24 0 a------- c:\windows\system32\19.tmp
2009-02-21 14:24 168 a------- c:\windows\system32\18.tmp
2009-02-21 14:09 0 a------- c:\windows\system32\11.tmp
2009-02-20 21:03 0 a------- c:\windows\system32\47.tmp
2009-02-20 19:58 0 a------- c:\windows\system32\45.tmp
2009-02-20 19:50 2,560 a------- c:\windows\system32\42.tmp
2009-02-20 19:50 0 a------- c:\windows\system32\3F.tmp
2009-02-20 19:49 208 a------- c:\windows\system32\3E.tmp
2009-02-20 18:50 2,560 a------- c:\windows\system32\32.tmp
2009-02-20 18:49 208 a------- c:\windows\system32\2D.tmp
2009-02-20 17:23 182,656 ac------ c:\windows\system32\dllcache\ndis.sys
2009-02-20 15:17 0 a------- c:\windows\system32\13.tmp
2009-02-20 09:53 0 ac------ c:\windows\system32\dllcache\chgport.exe.D0F5A1465EE6A8E8
2009-02-20 09:53 0 ac------ c:\windows\system32\dllcache\chkdsk.exe.9A4EEFEC4AB1F13F
2009-02-19 21:55 0 a------- c:\windows\system32\E2.tmp
2009-02-19 21:55 208 a------- c:\windows\system32\DB.tmp
2009-02-19 21:14 <DIR> --d----- c:\windows\ShellNew
2009-02-19 18:52 0 a------- c:\windows\system32\A2.tmp
2009-02-18 21:47 0 a------- c:\windows\system32\3A.tmp
2009-02-18 21:47 168 a------- c:\windows\system32\34.tmp
2009-02-18 17:28 0 a------- c:\windows\system32\12.tmp
2009-02-18 13:37 0 a------- c:\windows\system32\2E.tmp
2009-02-18 13:36 168 a------- c:\windows\system32\28.tmp
2009-02-17 17:49 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-17 17:44 <DIR> --d----- c:\docume~1\owner\applic~1\Malwarebytes
2009-02-17 17:43 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-17 17:43 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-17 17:43 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-17 17:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-16 19:50 <DIR> --d----- c:\docume~1\owner\applic~1\Twain
2009-02-16 19:45 <DIR> --d----- c:\program files\WebShow
2009-02-16 12:18 351 a------- c:\windows\xccwinsys.ini
2009-02-16 12:18 <DIR> --d----- c:\windows\system32\inf
2009-02-09 20:35 <DIR> --d----- c:\program files\Scholastic's Clifford
2009-02-05 15:43 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-02-05 10:38 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-02-05 10:38 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-05 10:38 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-02-05 10:38 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-02-05 09:56 <DIR> --d----- c:\program files\Unlocker
2009-02-05 09:29 <DIR> --d----- C:\tot
2009-01-29 19:04 <DIR> --d----- c:\program files\Windows Live Safety CenterRebootActions
2009-01-29 11:11 2,204 a------- c:\windows\vogxvvlw
2009-01-29 11:11 405,637 a--sh--- c:\windows\system32\PpWvCJjl.ini
==================== Find3M ====================
2009-02-25 07:51 578,560 a------- c:\windows\system32\user32.DLL
2009-02-24 06:43 10,767 a------- c:\program files\hijackthis.log
2009-02-20 17:23 182,656 a------- c:\windows\system32\drivers\ndis.sys
2009-02-20 10:03 122,880 a------- c:\windows\BCMSMMSG.exe
2009-02-20 09:52 126,976 a------- c:\windows\system32\hkcmd.exe
2009-02-20 09:51 221,184 a------- c:\windows\system32\LVCOMSX.EXE
2009-02-19 21:17 5,058 a------- c:\windows\help\hhcolreg.dat
2009-02-16 20:30 1,796 a------- c:\windows\mozver.dat
2009-01-19 10:57 5,598,390 a------- c:\windows\java\packages\MXBH77B9.ZIP
2009-01-19 10:57 4,254,721 a------- c:\windows\java\packages\W5R1R797.ZIP
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-10-06 12:40 848 a--sh--- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2008-10-06 12:40 88 ---shr-- c:\docume~1\alluse~1\applic~1\63242E44AA.sys
2008-09-03 21:34 284 a------- c:\docume~1\owner\applic~1\ViewerApp.dat
2008-08-29 19:39 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082920080830\index.dat
============= FINISH: 12:45:43.34 ===============