Severe infection, survives format\reinstall!

Evening.

Edit : I managed to browse to those "blocked" sites through vtunnel.com \ proxies. This confirms the virus' work, it knows what to block but it doesn't block proxy sites. This of course breaks java \ flash \ other applet "online scan"tools - they do not like functioning through a proxy... - but I can atleast look at some instructions...not that they help XD..usually.

Edit 2 : If I hold alt-tab down, I see a "blank process" on the leftmost item in the list. By blank process I mean a process box with a "Blank" icon. The standard white box that is the one you get when there isn't an icon linked to it. Doesn ot appear under processes in task manager, selecting it does nothing..shouldn't be there though I'm pretty sure.

This current infection first appeared almost a week ago, I noticed odd behaviour on my pc's part, spawned .dll, .exe, .tmp files and the like.

I have noticed a LOT of things, and can name about 4-7 viruses \ trojans that several anti-virus\spyware engines think this can belong to.

One thing is certain. I formatted twice and this SOB came back, from a clean install!
It's disgusting, and clearly, reinstalling will NOT solve the problem, so I must face it.

Of course this poses a problem, the virus is known to :

Slow my PC down
Mask \ infect as actually important files in an attempt to get me to delete them
Modified registry to make itself run on startup
Most spyware\virus software I have remove or block it but cannot keep it from coming back.
I beleive I have a backdoor\downloader, as several new viruses and or infected files spawn here and there, including the "IE 5 content" folder which I never use (Pft IE).
After a random amount of time, usually hours after the boot I am using, the virus would "break" my system. The task manager would not come up, citing a 1 line memory address crash - any and all internet communication is immediately cut and several other files \ functions cease to work \ properly.

I'm a smart user who's had protection before, I check most of my files, sources, and I do not randomly open emails I have no clue about.
I've formatted and reinstalled twice. The second time I had my internet cable out (Despite needing a network driver to make it WORK), before I ran virutfix (One of the viruses I have is confirmed to be an agressive Virut variation apparently. ) in safe mode, then installed AVG, scanned with that - all was clean and good.
I am still on the same boot after that. initially, on my previous installation, this would infect my winlogon.exe and instead of booting to desktop as it should, this SOB made windows display the "username \ pass" screen, which was what raised my curiousity the first time around.

MY correct understanding is that the virus modified registry keys \ strings and forces itself to load unless in safe mode, so it is always there.
Once the virus is on my pc, access to popular virus-aid sites are blocked (PrevX, ewido, symantec and so forth). I cannot browse to those sites, it refuses to let me.
I currently have AVG installed and Ad-Aware anniversary eidition. Both fully upgraded and technically working fine.

Ad-aware usually blocks a malicous DL \ process from loading, but more often than now, AVG tells me a new file has been found on "open".. Most of the time it cannot fix\heal the file, so I have to move it to the virus vault. These files come around once every 15 minutes on average - often duplicates.

CWShredder and Vundofix both did NOT detect either viruses on my computer, ruling them out.

I will now try to list the files I caught DURING THIS INSTALLATION which is not six hours old. I hope this helps narrow it down...


Windows\System32 :
\restore\rstrui.exe
\dllcache\iexpress.exe
\dllcache\fp98sadm.exe

msswchx.exe
DSndUp.exe

System volume information : A0000767 or 795.exe
\recycler\dd9.exe

vsdrgwrtje44.exe (Number at the end can vary)

It also likes spawning various ".tmp" extension files in my system32 \ temp \ prefertch folder.
Please, for the love of god, help me remove this thing, it's disgustingly persistent >-<.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:36:59, on 2009.05.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
E:\AVG8\avgtray.exe
D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Program Files\Analog Devices\Core\smax4pnp.exe
D:\Program Files\Analog Devices\SoundMAX\Smax4.exe
D:\WINDOWS\system32\RUNDLL32.EXE
E:\AVG8\avgwdsvc.exe
D:\WINDOWS\system32\nvsvc32.exe
E:\AVG8\avgemc.exe
E:\AVG8\avgrsx.exe
E:\AVG8\avgnsx.exe
E:\AVG8\avgcsrvx.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\dhcp\svchost.exe
E:\Steam\Steam.exe
D:\WINDOWS\system32\rundll32.exe
E:\AVG8\avgui.exe
E:\AVG8\avgcsrvx.exe
E:\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\AVG8\avgtoolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "D:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="D:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.50\english\PhysX_9.09.0203_SystemS oftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll
O20 - Winlogon Notify: avgrsstarter - D:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - E:\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - E:\AVG8\avgwdsvc.exe
O23 - Service: Dhcp server (DhcpSrv) - Unknown owner - D:\WINDOWS\dhcp\svchost.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4044 bytes

Note that \thunmail\testabd..dll isn't only a recurring virus it likes downloading - but I don't use thunderbird. I also of course "checked" it in hijackthis to remove it...

Edited by Blackwing Dragon, 04 May 2009 - 11:04 AM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
• Notepad will open with the results, click no to the Optional_Scan
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. You can find information on A/V control HERE

Orange Blossom

Due to the lack of feedback, this Topic is now closed.

In case you still have problems, please start a new topic.