Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

rundll32 errors and virtumonde.prx Sticking around.


  • Please log in to reply
15 replies to this topic

#1 tokemoke

tokemoke

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 28 April 2009 - 02:36 AM

I have run Malwarebytes, Spybot, VundoFix, and Advanced System Care (all up to date) in regular and safe mode multiple times and Spybot still shows Virtumonde.prx and I still get rundll32 errors on start up. Also says at start up that it cant find wumoyuvo.dll fopihofu.dll and huzitala.dll. I am running updated AVG and PC tools Spyware Doctor too.


DDS (Ver_09-03-16.01) - NTFSx86
Run by Unknown at 0:24:26.29 on Tue 04/28/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1167 [GMT -7:00]

AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated)
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\Unknown\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.netflix.com/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {565f549f-ffa0-4244-bf79-6dfa38f2eb10} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\avgtoolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\avgtoolbar.dll
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SmartDefrag] "c:\program files\iobit\iobit smartdefrag\IObit SmartDefrag.exe" /StartUp
uRun: [RTHDCPL] RTHDCPL.EXE
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Alcmtr] ALCMTR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [nwiz] nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRunOnce: [SpybotSnD] "c:\program files\spybot - search & destroy\SpybotSD.exe" /autocheck
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobe gamma loader.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\unknown\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {140120B9-B249-47FC-823D-ED14EBE5E2D5} = 10.0.9.0
TCP: {3FB52FE9-336E-462C-9BD9-88E2511C45E4} = 205.171.2.65,205.171.2.3
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\buhegavu.dll c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\lakovazo.dll c:\windows\system32\walikahe.dll c:\windows\system32\
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli c:\windows\system32\lakovazo.dll c:\windows\system32\walikahe.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\unknown\applic~1\mozilla\firefox\profiles\l3bmncak.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.quantumdiaries.org/|http://www.nsf.gov/index.jsp
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast,
============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-24 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-16 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-16 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-8-16 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-16 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-16 298264]
R2 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite xii.sp2c\RpcAgentSrv.exe [2008-7-1 98488]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-24 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-24 1095560]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\vmlaunch\buddyvm.sys --> c:\program files\vmlaunch\BuddyVM.sys [?]
S3 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-10-5 33752]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-6-29 24944]
S4 Pronpsrsnssh;Pronpsrsnssh; [x]

=============== Created Last 30 ================

2009-04-24 15:25 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-24 15:25 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-24 14:46 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-24 14:46 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-24 14:46 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-24 14:45 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-24 14:45 <DIR> --d----- c:\program files\common files\PC Tools
2009-04-24 14:45 <DIR> --d----- c:\program files\Spyware Doctor
2009-04-24 14:45 <DIR> --d----- c:\docume~1\unknown\applic~1\PC Tools
2009-04-24 14:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-24 00:52 230 a------- c:\windows\system32\spupdsvc.inf
2009-04-23 20:51 1,986,560 a------- c:\windows\system32\NCTAudioFile2.dll
2009-04-23 20:51 1,212,416 a------- c:\windows\system32\NCTAudioInformation2.dll
2009-04-23 20:51 835,584 a------- c:\windows\system32\NCTAudioCDGrabber2.dll
2009-04-23 20:51 348,160 a------- c:\windows\system32\NCTWMAFile2.dll
2009-04-23 20:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-04-23 20:51 237,568 a------- c:\windows\system32\lame_enc.dll
2009-04-23 20:51 113,486 a------- c:\windows\system32\NCTWMAProfiles.prx
2009-04-23 20:51 <DIR> --d----- c:\program files\Free Mp3WmaOgg Converter
2009-04-22 16:28 <DIR> --d----- c:\program files\Napster
2009-04-22 15:11 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-04-22 15:11 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-22 15:11 <DIR> --d----- c:\program files\iPod
2009-04-22 15:11 <DIR> --d----- c:\program files\iTunes
2009-04-22 15:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-22 15:11 <DIR> --d----- c:\program files\Bonjour
2009-04-14 21:05 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-13 16:52 <DIR> --d----- c:\docume~1\unknown\applic~1\Malwarebytes
2009-04-13 16:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-13 16:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-13 16:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-13 16:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-13 16:42 <DIR> --d----- C:\VundoFix Backups
2009-04-12 10:03 448 a------- c:\windows\wininit.ini
2009-04-09 11:27 <DIR> --d----- c:\docume~1\unknown\applic~1\HorizonWimba
2009-04-06 19:06 <DIR> --d----- c:\docume~1\unknown\applic~1\IMVU
2009-04-06 19:06 <DIR> --d----- c:\docume~1\unknown\applic~1\IMVUClient

==================== Find3M ====================

2009-03-30 15:07 325,640 a------- c:\windows\system32\drivers\avgldx86.sys
2009-03-30 15:07 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-03-30 15:07 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-03-06 07:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-02 17:18 826,368 -------- c:\windows\system32\wininet.dll
2009-03-02 17:18 826,368 -------- c:\windows\system32\dllcache\wininet.dll
2009-02-27 21:54 636,072 -------- c:\windows\system32\dllcache\iexplore.exe
2009-02-20 03:20 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-02-19 22:14 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2009-02-09 05:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 05:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 05:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 05:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 04:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-06 04:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 04:06 2,145,280 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 03:39 35,328 a------- c:\windows\system32\sc.exe
2009-02-06 03:32 2,023,936 a------- c:\windows\system32\ntkrnlpa.exe
2009-02-03 12:59 56,832 a------- c:\windows\system32\secur32.dll
2008-07-10 00:42 112,654 a------- c:\documents and settings\unknown\bitpim.dat

============= FINISH: 0:24:58.48 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 10 May 2009 - 01:57 PM

As you see this sub-forum is extremely busy, and we apologize for the delay in getting to your case.

Let's have you start with the following:

1. Set Windows to show all files and all folders.
On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.
Next, un-check Hide extensions for known file types.
Next un-check Hide protected operating system files.

2. Take out the trash (temporary files & temporary internet files)
Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.
Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:
Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
ATF-Cleaner should be run per the above in every user-login account {User Profile}

=
3. Important! => Open Notepad > Click on Format > Uncheck Word wrap, if checked. Exit Notepad.

=
Start your MBAM.
Click the Settings Tab. Make sure all option lines have a checkmark.
Click the Update tab. Press the "Check for Updates" button.
At this time, the current definitions are # 2102 or later. The latest program version is 1.36 (released April 6)

When done, click the Scanner tab.
Do a Quick Scan.

When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

=

Using Internet Explorer browser only, go to ESET Online Scanner website:
Vista users should start IE by Start (Vista Orb) >> Internet Explorer >> Right-Click and select Run As Administrator.
  • Accept the Terms of Use and press Start button;
  • Approve the install of the required ActiveX Control, then follow on-screen instructions;
  • Enable (check) the Remove found threats option, and run the scan.
  • After the scan completes, the Details tab in the Results window will display what was found and removed.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt.
Look at contents of this file using Notepad or Wordpad.

The Frequently Asked Questions for ESET Online Scanner can be viewed here
http://www.eset.com/onlinescan/cac4.php?page=faq
  • From ESET Tech Support: If you have ESET NOD32 installed, you should disable it prior to running this scanner.
    Otherwise the scan will take twice as long to do:
    everytime the ESET online scanner opens a file on your computer to scan it, NOD32 on your machine will rescan the file as a result.
  • It is emphasized to temporarily disable any pc-resident {active} antivirus program prior to any on-line scan by any on-line scanner.
    (And the prompt re-enabling when finished.)
  • If you use Firefox, you have to install IETab, an add-on. This is to enable ActiveX support.
=

Disable any script blocker if your antivirus/antimalware has it.
Then double click dds.scr to run new DDS reports.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop.
Download Security Check by screen317 and save it to your Desktop: here or here
  • Run Security Check
  • Follow the onscreen instructions inside of the command window.
  • A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!
Posted Image If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Please include the following logs in your next reply:
the Mbam scan log
the Eset scan log
DDS.txt
Attach.txt

checkup.txt
Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.
Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Edited by Maurice Naggar, 10 May 2009 - 01:59 PM.

~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#3 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 11 May 2009 - 03:41 PM

DDS (Ver_09-02-01.01) - NTFSx86
Run by Unknown at 13:35:55.57 on Mon 05/11/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1008 [GMT -7:00]

AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Unknown\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.netflix.com/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {565f549f-ffa0-4244-bf79-6dfa38f2eb10} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\avgtoolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\avgtoolbar.dll
TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SmartDefrag] "c:\program files\iobit\iobit smartdefrag\IObit SmartDefrag.exe" /StartUp
uRun: [RTHDCPL] RTHDCPL.EXE
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Alcmtr] ALCMTR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [nwiz] nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobe gamma loader.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\unknown\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {140120B9-B249-47FC-823D-ED14EBE5E2D5} = 10.0.9.0
TCP: {3FB52FE9-336E-462C-9BD9-88E2511C45E4} = 205.171.2.65,205.171.2.3
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\buhegavu.dll c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\ c:\windows\system32\lakovazo.dll c:\windows\system32\walikahe.dll c:\windows\system32\
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli c:\windows\system32\lakovazo.dll c:\windows\system32\walikahe.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\unknown\applic~1\mozilla\firefox\profiles\l3bmncak.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.quantumdiaries.org/|http://www.nsf.gov/index.jsp
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\emusic download manager\plugin\npemusic.dll
FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast,
============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-24 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-8-16 325896]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-8-16 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-8-16 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-16 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-16 298776]
R2 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite xii.sp2c\RpcAgentSrv.exe [2008-7-1 98488]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\vmlaunch\buddyvm.sys --> c:\program files\vmlaunch\BuddyVM.sys [?]
S3 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-10-5 33752]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-6-29 24944]
S3 keychain;M Three KeyChain Driver 03/09/2005, 1.0.0.2;c:\windows\system32\drivers\keychain.sys [2005-10-4 7936]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-24 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-24 1095560]
S4 Pronpsrsnssh;Pronpsrsnssh; [x]

=============== Created Last 30 ================

2009-05-11 11:09 <DIR> --d----- c:\program files\EsetOnlineScanner
2009-05-11 11:07 <DIR> --dsh--- c:\documents and settings\unknown\PrivacIE
2009-05-11 11:05 <DIR> --dsh--- c:\documents and settings\unknown\IETldCache
2009-05-11 11:02 <DIR> --d----- c:\windows\ie8updates
2009-05-11 11:00 <DIR> -cd-h--- c:\windows\ie8
2009-05-11 10:58 102,400 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-06 20:26 978 a------- c:\windows\eReg.dat
2009-05-03 21:06 <DIR> --d----- c:\docume~1\unknown\applic~1\eMusic
2009-05-03 21:04 <DIR> --d----- c:\program files\eMusic Download Manager
2009-04-30 18:24 <DIR> --d----- c:\docume~1\unknown\applic~1\Elluminate
2009-04-28 14:20 442,368 a----r-- c:\windows\system32\vp6vfw.dll
2009-04-28 14:20 <DIR> --d----- c:\program files\EA GAMES
2009-04-24 15:25 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-24 15:25 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-24 14:46 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-24 14:46 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-24 14:46 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-24 14:45 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-24 14:45 <DIR> --d----- c:\program files\common files\PC Tools
2009-04-24 14:45 <DIR> --d----- c:\program files\Spyware Doctor
2009-04-24 14:45 <DIR> --d----- c:\docume~1\unknown\applic~1\PC Tools
2009-04-24 14:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-23 20:51 1,986,560 a------- c:\windows\system32\NCTAudioFile2.dll
2009-04-23 20:51 1,212,416 a------- c:\windows\system32\NCTAudioInformation2.dll
2009-04-23 20:51 835,584 a------- c:\windows\system32\NCTAudioCDGrabber2.dll
2009-04-23 20:51 348,160 a------- c:\windows\system32\NCTWMAFile2.dll
2009-04-23 20:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-04-23 20:51 237,568 a------- c:\windows\system32\lame_enc.dll
2009-04-23 20:51 113,486 a------- c:\windows\system32\NCTWMAProfiles.prx
2009-04-23 20:51 <DIR> --d----- c:\program files\Free Mp3WmaOgg Converter
2009-04-22 16:28 <DIR> --d----- c:\program files\Napster
2009-04-22 15:11 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-04-22 15:11 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-22 15:11 <DIR> --d----- c:\program files\iPod
2009-04-22 15:11 <DIR> --d----- c:\program files\iTunes
2009-04-22 15:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-22 15:11 <DIR> --d----- c:\program files\Bonjour
2009-04-14 21:05 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-13 16:52 <DIR> --d----- c:\docume~1\unknown\applic~1\Malwarebytes
2009-04-13 16:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-13 16:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-13 16:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-13 16:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-13 16:42 <DIR> --d----- C:\VundoFix Backups
2009-04-12 10:03 448 a------- c:\windows\wininit.ini

==================== Find3M ====================

2009-05-05 09:09 325,896 a------- c:\windows\system32\drivers\avgldx86.sys
2009-05-05 09:09 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-05 09:08 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 07:22 284,160 a------- c:\windows\system32\pdh.dll
2009-02-20 11:09 133,120 -------- c:\windows\system32\dllcache\extmgr.dll
2008-07-10 00:42 112,654 a------- c:\documents and settings\unknown\bitpim.dat

============= FINISH: 13:36:11.87 ===============



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 6/29/2008 4:50:56 PM
System Uptime: 5/11/2009 11:04:26 AM (2 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | GA-MA770-DS3
Processor: AMD Athlon™ 64 X2 Dual Core Processor 5000+ | Socket M2 | 3104/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 298 GiB total, 193.716 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\1D7DDBF69B
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\1D7DDBF69B
Service: NIC1394

==== System Restore Points ===================

RP1: 4/27/2009 11:25:02 PM - System Checkpoint
RP2: 4/30/2009 5:51:37 PM - System Checkpoint
RP3: 5/1/2009 11:57:15 PM - System Checkpoint
RP4: 5/3/2009 4:38:57 PM - System Checkpoint
RP5: 5/4/2009 4:20:13 PM - Unsigned driver install
RP6: 5/5/2009 9:08:12 AM - Avg8 Update
RP7: 5/5/2009 9:09:19 AM - Avg8 Update
RP8: 5/5/2009 11:41:20 AM - Unsigned driver install
RP9: 5/6/2009 12:37:13 AM - Installed Firefox Quick Uploader plugin
RP10: 5/6/2009 8:16:33 PM - Installed Command & Conquer Generals
RP11: 5/6/2009 8:28:08 PM - Installed Command and ConquerTM Generals Zero Hour
RP12: 5/7/2009 10:16:29 PM - System Checkpoint
RP13: 5/9/2009 11:21:49 AM - System Checkpoint
RP14: 5/10/2009 11:18:45 PM - Advanced SystemCare RestorePoint
RP15: 5/11/2009 10:58:21 AM - Software Distribution Service 3.0
RP16: 5/11/2009 11:01:06 AM - Installed Windows Internet Explorer 8.
RP17: 5/11/2009 11:01:50 AM - Software Distribution Service 3.0

==== Installed Programs ======================

@BIOS
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop CS
Adobe Reader 7.0
Advanced SystemCare 3
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVG 8.5
BitPim 1.0.6.20080707
Bonjour
Command & Conquer Generals
Command and ConquerTM Generals Zero Hour
Critical Update for Windows Media Player 11 (KB959772)
Diablo II
Disciples 2 Gold Gallean
Disciples II Rise of the Elves
DivX Codec
DivX Player
DivX Web Player
DMIView B7.0108.01
eMusic Download Manager 4.1.1
ESET Online Scanner
Face_Wizard B07.0509.01
Firefox Quick Uploader plugin
Free Mp3/Wma/Ogg Converter 4.0.1
Freelancer
Game Booster
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
IMVU Avatar Chat Software
iTunes
Java™ 6 Update 13
LG USB Drivers
LG USB Modem driver
LightScribe System Software 1.10.13.1
Malwarebytes' Anti-Malware
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Game Studios Common Redistributables Pack 1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Word Viewer 2003
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
Moonbase Commander
Mozilla Firefox (3.0.4)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MySpaceIM
Napster Download Manager
neroxml
NVIDIA Drivers
OpenOffice.org 3.0
Prime95
QuickTime
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
SiSoftware Sandra Lite XII.SP2c
Smart Defrag 1.11
Spybot - Search & Destroy
Spyware Doctor 6.0
TEC
The Sims 2
The Sims 2 Nightlife
The Sims 2 Open For Business
The Sims 2 Pets
Unreal Anthology
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows XP (KB898461)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Veoh Web Player Beta
VeohTV BETA
VideoLAN VLC media player 0.8.6h
WebFldrs XP
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Internet Explorer 8
Windows Live installer
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver

==== Event Viewer Messages From Past Week ========

5/6/2009 9:54:05 AM, error: Service Control Manager [7000] - The BuddyVM service failed to start due to the following error: The system cannot find the path specified.

==== End Of File ===========================


Results of screen317's Security Check version 0.98.3
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
``````````````````````````````

Windows Firewall Enabled!
ESETOnlineScanner
AVG8.5
``````````````````````````````
Anti-malware/Other Utilities Check:
``````````````````````````````

Spyware Doctor 6.0
Spybot - Search & Destroy
Malwarebytes' Anti-Malware
Java™ 6 Update 13
``````````````````````````````
Process Check:
objlist.exe by Laurent
``````````````````````````````

AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
AVG avgemc.exe
Spybot SDHelper is disabled!
Spybot - Search & Destroy TeaTimer.exe
``````````````````````````````
DNS Vulnerability Check:
``````````````````````````````

GREAT! (Very random)

Scan took 12 seconds.
`````````End of Log```````````

#4 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 11 May 2009 - 03:47 PM

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=4065 (20090511)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=20ce98419ba06a49b7cddb42ecf73274
# end=finished
# remove_checked=true
# unwanted_checked=false
# utc_time=2009-05-11 08:30:19
# local_time=2009-05-11 01:30:19 (-0800, Pacific Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=237574
# found=0
# scan_time=1758



Malwarebytes' Anti-Malware 1.36
Database version: 1979
Windows 5.1.2600 Service Pack 3

4/13/2009 5:18:33 PM
mbam-log-2009-04-13 (17-18-33).txt

Scan type: Full Scan (C:\|)
Objects scanned: 139872
Time elapsed: 20 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\zofitemi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zeyevavi.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{565f549f-ffa0-4244-bf79-6dfa38f2eb10} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{565f549f-ffa0-4244-bf79-6dfa38f2eb10} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{565f549f-ffa0-4244-bf79-6dfa38f2eb10} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hajebogivi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zofitemi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\zofitemi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\zeyevavi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zofitemi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sesanujo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.


I understand the delay and appreciate your help. Thanks. Problems haven't been to bad lately. Firefox will lag sometimes and a popup will appear. No more rundll32 errors on startup.

#5 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 11 May 2009 - 08:42 PM

MBAM has removed a number of Vundo files, even so I'd like to have you run a few more tools to be safe.
Have plenty of patience while these tools run, and let them run by themselves. Don't start other apps while they are running.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference! Perhaps also save the file on your pc.

Disable Spybot's Tea Timer and keep it that way:
Right click the Spybot Icon in the system tray (notification area).
  • If you have the new version 1.5, click once on Resident Protection and make sure it is Unchecked.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident

    If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
    Exit Spybot S&D when done and reboot the system so the changes are in effect.
=

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1
Link 2
Link 3

Posted Image


Posted Image


* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop
If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on Combo-Fix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:
Posted Image
then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
-------------------------------------------------------

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light.
If it is flashing, Combofix is still at work.
=

Next:
1. Please download SmitfraudFix (by S!Ri) and SAVE it to your Desktop.
Posted ImageIt's very important that you be using the most recent version (v2.416 as of this post).

2. Reboot into Safe Mode (Restart your computer, then continually tap F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. More at http://service1.symantec.com/SUPPORT/tsgen...001052409420406.)

3. Once in Safe Mode:
Double click the SmitFruadfix.exe file. It will create a folder named SmitfraudFix) on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Have plenty of patience as a Command prompt window opens. You'll eventually see a message and a "press any key to continue".
Press the space bar or any other key on the keyboard.

4. Select option #2 - Clean by typing 2 and pressing Enter to delete infected files.

5. You will be prompted: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and pressing Enter in order to remove the desktop background and clean registry keys associated with the infection.

6. The tool will then check if wininet.dll is infected. If prompted to replace the infected file (if found), answer "Yes" by typing Y and pressing Enter.

7. The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

8. A text file will appear onscreen with results from the cleaning process. Please copy/paste the content of that report into your next reply.

The report also may be found at the root of the system drive, usually at C:\rapport.txt

Notes:
  • process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. More on this at http://www.beyondlogic.org/consulting/proc...processutil.htm
  • Running option #2 on a non-infected computer will remove your Desktop background. No need to worry, you were infected
Next, Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

=
Please download and run the Trend Micro Sysclean Package on your computer.
NOTE! This scan will probably take a long time to run on your computer so be patient and don't use it while it's scanning.
  • Create a brand new folder to copy these files to.
  • As an example: C:\DCE
  • Then open each of the zipped archive files and copy their contents to C:\DCE
  • Copy the file sysclean.com to the new folder C:\DCE as well.
  • Double-click on the file sysclean.com that is in the C:\DCE folder and follow the on-screen instructions.

    After doing all of this, please post back your results, including the log file sysclean.log that will be left behind by sysclean.
How To Use Compressed (Zipped) Folders in Windows XP
Compress and uncompress files (zip files) in Vista

RE-Enable your AntiVirus and AntiSpyware applications.

Reply with copies of the following:
C:\Combofix.txt
C:\rapport.txt
Goored.txt
Sysclean.log and
tell me, How is your system now ?
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#6 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 16 May 2009 - 11:53 AM

Do provide an update on the status of this system. Thank you.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#7 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 16 May 2009 - 06:35 PM

I got as far as running combofix and it keeps telling me AVG is still running. I exit the program via the tray icon, still running. I deselect avg from starting with the system in msconfig, still running. I UNINSTALLED it and restarted, Twice..... still running. AVG seems like another problem program if I can't get rid of it when I want to. How do I proceed?

#8 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 16 May 2009 - 06:50 PM

Take a look at this reference on this forum about turning off your AVG AV
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Further, iirc, Combofix is prompting you and there's an option to proceed forward anyway.

If really and truly blocked from running Combofix, proceed forward with the remaining steps I outlined before.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#9 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 17 May 2009 - 01:02 AM

After running everything prescribed, I ran spybot. It still came up with Virtumonde.sdn and Right Media. Cleaned successfully. Rescanned and came up empty. Will update on pop up occurrences.



/--------------------------------------------------------------\
| Trend Micro System Cleaner |
| Copyright 2006-2007, Trend Micro, Inc. |
| http://www.antivirus.com |
\--------------------------------------------------------------/


2009-05-16, 21:44:36, Auto-clean mode specified.
2009-05-16, 21:44:36, Initialized Rootkit Driver version 2.2.0.1004.
2009-05-16, 21:44:36, Running scanner "C:\Documents and Settings\Unknown\Desktop\DCE\TSC.BIN"...
2009-05-16, 21:44:47, Scanner "C:\Documents and Settings\Unknown\Desktop\DCE\TSC.BIN" has finished running.
2009-05-16, 21:44:47, TSC Log:

D a m a g e C l e a n u p E n g i n e ( D C E ) 6 . 0 ( B u i l d 1 1 7 2 )


W i n d o w s X P ( B u i l d 2 6 0 0 : S e r v i c e P a c k 3 )




S t a r t t i m e : S a t M a y 1 6 2 0 0 9 2 1 : 4 4 : 3 7





L o a d D a m a g e C l e a n u p T e m p l a t e ( D C T ) " C : \ D o c u m e n t s a n d S e t t i n g s \ U n k n o w n \ D e s k t o p \ D C E \ T M R D C T . p t n " ( v e r s i o n ) [ f a i l ]


L o a d D a m a g e C l e a n u p T e m p l a t e ( D C T ) " C : \ D o c u m e n t s a n d S e t t i n g s \ U n k n o w n \ D e s k t o p \ D C E \ t s c . p t n " ( v e r s i o n 1 0 3 4 ) [ s u c c e s s ]





C o m p l e t e t i m e : S a t M a y 1 6 2 0 0 9 2 1 : 4 4 : 4 7


E x e c u t e p a t t e r n c o u n t ( 3 0 5 1 ) , V i r u s f o u n d c o u n t ( 0 ) , V i r u s c l e a n c o u n t ( 0 ) , C l e a n f a i l e d c o u n t ( 0 )





2009-05-16, 21:44:47, Running scanner "C:\Documents and Settings\Unknown\Desktop\DCE\VSCANTM.BIN"...
2009-05-16, 22:07:13, Scanner "C:\Documents and Settings\Unknown\Desktop\DCE\VSCANTM.BIN" has finished running.
2009-05-16, 22:07:13, VSCANTM Log:

2009-05-16, 22:07:13, Files Detected:
Copyright © 1990 - 2006 Trend Micro Inc.
Report Date : 5/16/2009 21:44:47
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)

VSGetVirusPatternInformation is invoked

Virus Pattern Version : 133 (398052/398052 Patterns) (2009/05/15) (613300)

Command Line: C:\Documents and Settings\Unknown\Desktop\DCE\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=C:\Documents and Settings\Unknown\Desktop\DCE\lpt$vpn.133

78138 files have been read.
78138 files have been checked.
78104 files have been scanned.
212359 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 5/16/2009 22:07:13 22 minutes 26 seconds (1345.22 seconds) has elapsed.(17.216 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2009-05-16, 22:07:13, Files Clean:
Copyright © 1990 - 2006 Trend Micro Inc.
Report Date : 5/16/2009 21:44:47
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)

VSGetVirusPatternInformation is invoked

Virus Pattern Version : 133 (398052/398052 Patterns) (2009/05/15) (613300)

Command Line: C:\Documents and Settings\Unknown\Desktop\DCE\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=C:\Documents and Settings\Unknown\Desktop\DCE\lpt$vpn.133

78138 files have been read.
78138 files have been checked.
78104 files have been scanned.
212359 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 5/16/2009 22:07:13 22 minutes 26 seconds (1345.22 seconds) has elapsed.(17.216 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2009-05-16, 22:07:13, Clean Fail:
Copyright © 1990 - 2006 Trend Micro Inc.
Report Date : 5/16/2009 21:44:47
VSAPI Engine Version : 8.910-1002
VSCANTM Version : 3.00-1018 (Official Build)

VSGetVirusPatternInformation is invoked

Virus Pattern Version : 133 (398052/398052 Patterns) (2009/05/15) (613300)

Command Line: C:\Documents and Settings\Unknown\Desktop\DCE\VSCANTM.BIN /NBPM /S /CLEANALL /LD /LC /LCF /NM /NB /DCEGENCLEAN /HIDEDCECONSOLE /C /ACTIVEACTION=5 /VSBKENC+ /HOSPITAL=.\BACKUP /LR C:\*.* /P=C:\Documents and Settings\Unknown\Desktop\DCE\lpt$vpn.133

78138 files have been read.
78138 files have been checked.
78104 files have been scanned.
212359 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At: 5/16/2009 22:07:13 22 minutes 26 seconds (1345.22 seconds) has elapsed.(17.216 msec/file)
---------*---------*---------*---------*---------*---------*---------*---------*
2009-05-16, 22:07:13, Running SSAPI scanner ""...
2009-05-16, 22:18:57, SSAPI Log:

SSAPI Scanner Version: 1.0.1003
SSAPI Engine Version: 5.2.1032
SSAPI Pattern Version: 7.67
SSAPI Anti-Rootkit Version: 2.2.0.1004

Spyware Scan Started: 05/16/2009 22:07:15

Detected: 0 items.

Spyware Scan Ended: 05/16/2009 22:18:57
Scan Complete. Time=704.055298.


GooredFix v1.92 by jpshortstuff
Log created at 21:22 on 16/05/2009 running Option #1 (Unknown)
Firefox version 3.0.4 (en-US)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.4\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.4\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1d5287d1-8a92-0001-1f31-1cec198018d8}"="C:\Program Files\AVG\AVG8\ToolbarFF"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox"



SmitFraudFix v2.416

Scan done at 21:12:22.35, Sat 05/16/2009
Run from C:\Documents and Settings\Unknown\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

127.0.0.1 localhost

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files


IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


RK


DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{140120B9-B249-47FC-823D-ED14EBE5E2D5}: NameServer=10.0.9.0
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3FB52FE9-336E-462C-9BD9-88E2511C45E4}: NameServer=205.171.2.65,205.171.2.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{140120B9-B249-47FC-823D-ED14EBE5E2D5}: NameServer=10.0.9.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3FB52FE9-336E-462C-9BD9-88E2511C45E4}: NameServer=205.171.2.65,205.171.2.3
HKLM\SYSTEM\CS2\Services\Tcpip\..\{140120B9-B249-47FC-823D-ED14EBE5E2D5}: NameServer=10.0.9.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3FB52FE9-336E-462C-9BD9-88E2511C45E4}: NameServer=205.171.2.65,205.171.2.3


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


RK.2



Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End

ComboFix 09-05-16.05 - Unknown 05/16/2009 19:48.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1346 [GMT -7:00]
Running from: c:\documents and settings\Unknown\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://82.98.235.228
hxxp://82.98.235.205
.
((((((((((((((((((((((((( Files Created from 2009-04-17 to 2009-05-17 )))))))))))))))))))))))))))))))
.

2009-05-11 18:09 . 2009-05-11 20:30 -------- d-----w c:\program files\EsetOnlineScanner
2009-05-11 18:07 . 2009-05-11 18:07 -------- d-sh--w c:\documents and settings\Unknown\PrivacIE
2009-05-11 18:05 . 2009-05-11 18:05 -------- d-sh--w c:\documents and settings\Unknown\IETldCache
2009-05-11 18:02 . 2009-05-11 18:02 -------- d-----w c:\windows\ie8updates
2009-05-11 18:00 . 2009-05-11 18:01 -------- dc-h--w c:\windows\ie8
2009-05-11 17:58 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-07 03:26 . 2009-05-07 03:39 978 ----a-w c:\windows\eReg.dat
2009-05-06 07:38 . 2009-05-06 07:39 -------- d-----w c:\documents and settings\Unknown\Application Data\Snapfish
2009-05-04 04:06 . 2009-05-15 23:48 -------- d-----w c:\documents and settings\Unknown\Application Data\eMusic
2009-05-04 04:06 . 2009-05-04 04:06 -------- d-----w c:\documents and settings\Unknown\Local Settings\Application Data\eMusic
2009-05-04 04:04 . 2009-05-15 23:48 -------- d-----w c:\program files\eMusic Download Manager
2009-05-01 01:24 . 2009-05-01 01:25 -------- d-----w c:\documents and settings\Unknown\Application Data\Elluminate
2009-04-28 21:20 . 2009-05-07 03:34 -------- d-----w c:\program files\EA GAMES
2009-04-28 21:20 . 2005-09-28 04:11 442368 ----a-r c:\windows\system32\vp6vfw.dll
2009-04-24 22:25 . 2009-04-24 22:25 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-24 21:46 . 2008-12-11 15:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys
2009-04-24 21:46 . 2008-12-18 19:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-24 21:46 . 2009-04-03 18:18 130936 ----a-w c:\windows\system32\drivers\PCTCore.sys
2009-04-24 21:45 . 2009-05-11 18:09 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-24 21:45 . 2009-04-24 21:57 -------- d-----w c:\program files\Common Files\PC Tools
2009-04-24 21:45 . 2008-12-10 18:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys
2009-04-24 21:45 . 2009-05-08 06:32 -------- d-----w c:\program files\Spyware Doctor
2009-04-24 21:45 . 2009-04-24 21:45 -------- d-----w c:\documents and settings\Unknown\Application Data\PC Tools
2009-04-24 21:45 . 2009-04-24 21:45 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-04-24 03:51 . 2007-10-25 01:57 835584 ----a-w c:\windows\system32\NCTAudioCDGrabber2.dll
2009-04-24 03:51 . 2005-02-24 18:51 348160 ----a-w c:\windows\system32\NCTWMAFile2.dll
2009-04-24 03:51 . 2007-10-25 01:57 1986560 ----a-w c:\windows\system32\NCTAudioFile2.dll
2009-04-24 03:51 . 2007-10-16 22:38 1212416 ----a-w c:\windows\system32\NCTAudioInformation2.dll
2009-04-24 03:51 . 2002-01-05 21:37 344064 ----a-w c:\windows\system32\msvcr70.dll
2009-04-24 03:51 . 2003-08-07 22:01 237568 ----a-w c:\windows\system32\lame_enc.dll
2009-04-24 03:51 . 2009-04-24 03:51 -------- d-----w c:\program files\Free Mp3WmaOgg Converter
2009-04-22 23:28 . 2009-04-22 23:28 -------- d-----w c:\program files\Napster
2009-04-22 22:11 . 2008-04-17 19:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-04-22 22:11 . 2009-03-19 23:32 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-22 22:11 . 2009-04-22 22:11 -------- d-----w c:\program files\iPod
2009-04-22 22:11 . 2009-04-22 22:11 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-22 22:11 . 2009-04-22 22:11 -------- d-----w c:\program files\iTunes
2009-04-22 22:11 . 2009-04-22 22:11 -------- d-----w c:\program files\Bonjour
2009-04-22 22:10 . 2009-04-22 22:10 -------- d-----w c:\program files\QuickTime
2009-04-22 22:10 . 2009-04-22 22:11 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 21:09 . 2008-06-29 23:54 22256 ----a-w c:\documents and settings\Unknown\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-07 03:47 . 2008-06-30 01:02 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-05 16:09 . 2008-08-17 05:24 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-05 16:09 . 2008-08-17 05:24 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-05 16:08 . 2008-08-17 05:24 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-24 22:25 . 2008-07-02 00:04 -------- d-----w c:\program files\Java
2009-04-24 07:54 . 2008-10-20 23:48 -------- d-----w c:\program files\Windows Live
2009-04-22 22:11 . 2008-09-09 21:44 -------- d-----w c:\program files\Common Files\Apple
2009-04-13 23:51 . 2009-04-13 23:51 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 04:58 . 2008-07-02 00:26 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-07 03:15 . 2008-07-15 07:39 -------- d-----w c:\program files\MySpace
2009-04-06 22:32 . 2009-04-13 23:51 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32 . 2009-04-13 23:51 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-02 06:44 . 2008-07-01 23:35 -------- d-----w c:\program files\IObit
2009-03-23 05:34 . 2009-03-23 05:34 -------- d-----w c:\program files\Common Files\Adobe Systems Shared
2009-03-23 05:34 . 2008-07-05 06:15 -------- d-----w c:\program files\Common Files\Adobe
2009-03-15 21:29 . 2009-03-15 21:29 0 ----a-w c:\windows\PowerReg.dat
2009-03-08 11:34 . 2008-04-14 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2008-04-14 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2008-04-14 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2008-04-14 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2008-04-14 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2008-04-14 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 11:31 . 2008-04-14 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2008-04-14 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2008-04-14 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2008-04-14 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-14 12:00 284160 ----a-w c:\windows\system32\pdh.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2008-12-16 3528440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"SmartDefrag"="c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2009-02-14 1986896]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-08-20 16384512]
"Alcmtr"="ALCMTR.EXE" - c:\windows\Alcmtr.exe [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-24 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-05 1947928]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-04 1626112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-22 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-05 16:09 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Unreal Anthology\\UT2004\\System\\UT2004.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Strategy First\\Disciples 2 Gold Elves\\Discipl2.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [4/24/2009 2:46 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/16/2008 10:24 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/16/2008 10:24 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/16/2008 10:24 PM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/16/2008 10:24 PM 298776]
R2 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe [7/1/2008 10:45 PM 98488]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;\??\c:\program files\VMLaunch\BuddyVM.sys --> c:\program files\VMLaunch\BuddyVM.sys [?]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [10/5/2008 9:17 PM 33752]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [6/29/2008 7:01 PM 24944]
S3 keychain;M Three KeyChain Driver 03/09/2005, 1.0.0.2;c:\windows\system32\drivers\keychain.sys [10/4/2005 2:16 AM 7936]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/24/2009 2:45 PM 348752]
S4 Pronpsrsnssh;Pronpsrsnssh; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-02-21 02:15]
.
- - - - ORPHANS REMOVED - - - -

BHO-{565f549f-ffa0-4244-bf79-6dfa38f2eb10} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.netflix.com/
uInternet Settings,ProxyOverride = *.local
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Unknown\Start Menu\Programs\IMVU\Run IMVU.lnk
TCP: {140120B9-B249-47FC-823D-ED14EBE5E2D5} = 10.0.9.0
TCP: {3FB52FE9-336E-462C-9BD9-88E2511C45E4} = 205.171.2.65,205.171.2.3
FF - ProfilePath - c:\documents and settings\Unknown\Application Data\Mozilla\Firefox\Profiles\l3bmncak.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.quantumdiaries.org/|http://www.nsf.gov/index.jsp|http://today.slac.stanford.edu/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast, .

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-16 19:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3732)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-05-17 19:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-17 02:51

Pre-Run: 207,221,272,576 bytes free
Post-Run: 207,158,480,896 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

227 --- E O F --- 2009-05-13 08:06

#10 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 17 May 2009 - 06:20 AM

There's a bit more work to do to make sure any further traces of Vundo are gone. Continue to have patience. These next runs are worth the investment in time and effort.

Your initial logs showed both AVG AV & also Spyware Docotor's Antivirus both active, which leads to conflicts.
Any system should ONLY have 1 active antivirus program.
Please tell me if you have purchased Spyware Doctor. If you have not, I recommend you un-install it & if you do so, then logoff & restart the system fresh.

The Combofix log showed the 2 AVs disabled, which is good before running Combofix. I assume you want to keep AVG AV. At some point later on, you will need to re-activate (re-enable) AVG.
This next from Combofix log

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)

=
Once more let's make sure Spybot's Tea Timer is out of the way & is in-active ! An active Tea Timer will reverse changes we need to make to registry.

Start Spybot
Click Mode - Advanced Mode - Click Yes
Click tools on the bottom left pane.
Click Resident
Then uncheck Teatimer, protection over all systems active.
Close spybot.
Now Logoff and Restart Windows for a fresh start.

Using My Computer {Windows Explorer} look for this folder
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots

If you find the Snapshots folder, then look at it's contents. If any files are present, delete them all.

=
Place your USB flash drives in-place so that some of these programs will be able to find them.

I'm going to have you get and run two utilities.
The first stops automatic use of the AutoRun feature of XP. The second will write to any connected devices a Read-only, System protected Autorun.inf file on all of your hard drives, and all connected removable storage devices.

Download and Install Microsoft's TweakUI:
http://www.microsoft.com/windowsxp/downloa...ppowertoys.mspx
Obtain and install TweakUI (part of the PowerToys for Windows XP package), and then start TweakUI.
Expand the My Computer branch, then the AutoPlay branch, and then select Drives.
Turn off the checkbox next to every drive letter to disable AutoPlay -- except your CD/DVD drive letters.

Download and run "Flash Drive Disinfector" by sUBs. It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe
There is no GUI interface or log file produced.
=
  • Download OTListIt by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTListIt2.exe
  • Please double-click OTListIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy all the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :OTLI
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    
    :files
    C:\WINDOWS\system32\wumoyuvo.dll
    C:\WINDOWS\system32\fopihofu.dll
    C:\WINDOWS\system32\huzitala.dll
    C:\WINDOWS\system32\buhegavu.dll
    C:\WINDOWS\system32\lakovazo.dll
    C:\WINDOWS\system32\walikahe.dll
    g:\recycler
    h:\recycler
    i:\recycler
    j:\recycler
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [reboot]
  • Return to OTLisIt2. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
  • Close any browser(s) windows that may be open.
  • Using your mouse, click on the red-lettered button Run Fix.
  • Once you see a message box "Fix complete! Click OK to open the fix log."
    Click the OK button
  • The log will open in Notepad (your default text editor).
  • Save the log. Post a copy of that log in your next reply.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTListIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

=
Download and save to your Dekstop: PrevX CSI: http://www.prevx.com/freescan.asp

Run Prevx CSI.
If it wants to reboot when finished, do so.


Start your MBAM.
Click the Settings Tab. Make sure all option lines have a checkmark.
Click the Update tab. Press the "Check for Updates" button.
At this time, the current definitions are # 2144 or later. The latest program version is 1.36 (released April 6)

When done, click the Scanner tab.
Do a Quick Scan.

When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

=

Scan the system with the Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner

Posted Image Attention: Kaspersky Online Scanner 7.0 may not run successfully while another antivirus program is running. If you have Anti-Virus software installed, please temporarily disable your AV protection before running the Kaspersky Online Scanner. Reenable it after the scan is finished.

During this run, make sure your browser does not block popup windows. Have patience while some screens populate.

1) Click the Kapersky Online Scanner button. You'll see a popup window.
2) Accept the agreement
3) Accept the installation of the required ActiveX object ( XP SP2-SP3 will show this in the Information Bar )
4) For XP SP2-SP3, click the Install button when prompted
5) The necessary files will be downloaded and installed. Please have plenty of patience.
6) After Kaspersky AntiVirus Database is updated, look at the Scan box.
7) Click the My Computer line
8 ) Be infinetely patient, the scan is comprehensive and, unlike other online antivirus scanners, will detect all malwares

9) When the scan is completed there will be an option to Save report as a .txt file. Click that button. Copy and paste the report into your reply.

( To see an animated tutorial-how-to on the scan, see >>this link<<)

Re-enable your antivirus program after Kaspersky has finished.
Kapersky Online Scanner can be uninstalled later on from Add or Remove Programs in the Control Panel, if desired.

Do not be alarmed if Kaspersky tags items that are already in quarantine by MBAM, or SmitFraudFix items, or ComboFix's Qoobox & quarantine.
Kaspersky is a report only and does not remove files.

Post back with copies of these reports in the following order:
OTListIt2 Movedfiles log
the new MBAM scan log
Kaspersky.txt report.
How is your system now ?
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#11 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 23 May 2009 - 02:05 PM

Error: Unable to interpret <CODE> in the current context!
Error: Unable to interpret <:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:files
C:\WINDOWS\system32\wumoyuvo.dll
C:\WINDOWS\system32\fopihofu.dll
C:\WINDOWS\system32\huzitala.dll
C:\WINDOWS\system32\buhegavu.dll
C:\WINDOWS\system32\lakovazo.dll
C:\WINDOWS\system32\walikahe.dll
g:\recycler
h:\recycler
i:\recycler
j:\recycler

:Commands
[purity]
[emptytemp]
[start explorer]
[reboot]> in the current context!

OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05172009_140324


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Saturday, May 23, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Saturday, May 23, 2009 14:58:51
Records in database: 2226468
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 83178
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:57:29

No malware has been detected. The scan area is clean.

The selected area was scanned.


Malwarebytes' Anti-Malware 1.36
Database version: 2145
Windows 5.1.2600 Service Pack 3

5/23/2009 11:44:29 AM
mbam-log-2009-05-23 (11-44-29).txt

Scan type: Quick Scan
Objects scanned: 16986
Time elapsed: 2 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

So far so good.

#12 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 23 May 2009 - 03:18 PM

So far so good, yes. The Kaspersky scan found nothing, as did MBAM. But....the MBAM has older definitions & needs updating.
Further, It appears you did not copy all lines for the OTListIt2 steps.
I'm going to have you use Avenger instead. Make sure to follow instructions closely.


Download The Avenger by Swandog46 from here.
  • Unzip/extract it to a folder on your desktop.
  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Files to delete:
    C:\WINDOWS\system32\wumoyuvo.dll
    C:\WINDOWS\system32\fopihofu.dll
    C:\WINDOWS\system32\huzitala.dll
    C:\WINDOWS\system32\buhegavu.dll
    C:\WINDOWS\system32\lakovazo.dll
    C:\WINDOWS\system32\walikahe.dll
    
    Folders to delete:
    C:\recycler
    D:\recycler
    e:\recycler
    f:\recycler
    g:\recycler
    h:\recycler
  • In the avenger window, click the Paste Script from Clipboard icon, Posted Image button.
  • Posted Image Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above for ALL lines in between the dashed lines.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.
Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.
If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.
and then reboot the system again.

Start your MBAM.
Click the Settings Tab. Make sure all option lines have a checkmark.
Click the Update tab. Press the "Check for Updates" button.
At this time, the current definitions are # 2171 or later. The latest program version is 1.36 (released April 6)

When done, click the Scanner tab.
Do a Quick Scan.

When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Next, reply with copy of the C:\Avenger.txt
and the MBAM scan log
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#13 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 26 May 2009 - 01:48 PM

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\wumoyuvo.dll" not found!
Deletion of file "C:\WINDOWS\system32\wumoyuvo.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\fopihofu.dll" not found!
Deletion of file "C:\WINDOWS\system32\fopihofu.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\huzitala.dll" not found!
Deletion of file "C:\WINDOWS\system32\huzitala.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\buhegavu.dll" not found!
Deletion of file "C:\WINDOWS\system32\buhegavu.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\lakovazo.dll" not found!
Deletion of file "C:\WINDOWS\system32\lakovazo.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\walikahe.dll" not found!
Deletion of file "C:\WINDOWS\system32\walikahe.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Folder "C:\recycler" deleted successfully.

Error: could not open folder "D:\recycler"
Deletion of folder "D:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "e:\recycler"
Deletion of folder "e:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "f:\recycler"
Deletion of folder "f:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "g:\recycler"
Deletion of folder "g:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open folder "h:\recycler"
Deletion of folder "h:\recycler" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 5.1.2600 Service Pack 3

5/26/2009 11:46:49 AM
mbam-log-2009-05-26 (11-46-49).txt

Scan type: Quick Scan
Objects scanned: 80656
Time elapsed: 2 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#14 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:29 AM

Posted 29 May 2009 - 06:10 AM

First, Close all applications and windows.
If you have an older copy of SDFix, delete it now.
Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual user account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back in a Reply here.
Get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm

Steps to follow for the MVP Hosts file:
1) Download and SAVE the zip file to a temporary folder
2) Unzip (extract the contents) in the same folder
3) After extract is complete, run mvps.bat batch file. This copies your pre-existing Hosts file to Hosts.mvp in the folder where Windows' Hosts resides
typically, C:\WINDOWS\system32\drivers\etc

and after that copy is saved, it replaces the old Hosts with the new one.

And you should see (in the blue background command window) the following:

_________________________________________________
+---+
THE MVPS HOSTS FILE IS NOW UPDATED v
+---+



Previous version saved and renamed to HOSTS.MVP
Press any key to continue . . .


Find the folder where you saved the original download. Delete hosts.zip and a file folder there named hosts
The latter is the same folder that had mvps.bat

Reply with a copy of Report.txt from above,
and tell me, How is your system now?

I believe it looks good: the Kaspersky scan found nothing, as did the last MBAM scan.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#15 tokemoke

tokemoke
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:02:29 AM

Posted 05 June 2009 - 10:09 PM

SDFix: Version 1.240
Run by Unknown on Fri 06/05/2009 at 07:38 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 19:42:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:a7,0e,0b,b9,c0,17,6c,ee,e2,21,f8,e1,36,28,25,64,6b,cb,76,29,ef,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:a7,0e,0b,b9,c0,17,6c,ee,e2,21,f8,e1,36,28,25,64,6b,cb,76,29,ef,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\RpcAgentSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service"
"C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\WNt500x86\\RpcSandraSrv.exe"="C:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XII.SP2c\\WNt500x86\\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"="C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe:*:Enabled:Veoh Client"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Unreal Anthology\\UT2004\\System\\UT2004.exe"="C:\\Unreal Anthology\\UT2004\\System\\UT2004.exe:*:Enabled:UT2004"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Strategy First\\Disciples 2 Gold Elves\\Discipl2.exe"="C:\\Program Files\\Strategy First\\Disciples 2 Gold Elves\\Discipl2.exe:*:Enabled:Disciples II v3.01"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\\Program Files\\Java\\jre6\\bin\\java.exe"="C:\\Program Files\\Java\\jre6\\bin\\java.exe:*:Enabled:Java™ Platform SE binary"
"C:\\Program Files\\Java\\jre6\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre6\\bin\\javaw.exe:*:Enabled:Java™ Platform SE binary"
"C:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat"="C:\\Program Files\\EA GAMES\\Command & Conquer Generals Zero Hour\\game.dat:*:Enabled:game"
"C:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"="C:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe:*:Enabled:Veoh Web Player "
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Thu 10 Jul 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 13 May 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"

Finished!

Updated Spybot and MBAM. They found nothing. What programs would you recommend for regular maintenance?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users