Infected - Vundo.H + ?

Hi! I have read a lot from this website before, and have used information from here to clean infections before. This one is just nuts! it's the first time I have needed more help than just google and trial-and-error (maybe a little cursing)! I think it's the vundo.H (that's what malwareBytes says). MalwareBytes finds it and says it will clean it, but upon a reboot, there is always one entry in the startup that is some funky name (like vahipoja.dll I see all of these in the log) that is being registered. I have tried to manually delete them with a UBCD, and delete the BHO's as well. Apperantly I am missing something though, because they come back. Sometimes the pc runs fine for hours before going nuts. Then it will start one or more fake 'antivirus/malware' programs 'scanning' the machine. It disables Safe Mode (I can fix that in the reg), regedit, task manager, msconfig, redirects internet downloads/searches, turns off the REAL antivirus, turns off spybot, and disables usb and even the cd-rom (the only way to get files on or off of it at that point is with ubcd or a linux live cd).

We got hit on 3 pc's at the same time, and I reinstalled on 2 of them and kept this one to try to heal. I am at my wits end with this thing! I am pretty sure it was out of date java client that caused it, but not positive (java WAS out of date though -- I don't know how to get that through to people. . .it's so easy to update. . .) I view this as a learning experience, and a way to help me help myself in the future. Any help will be greatly appreciated!

Thank you very much in advance!


DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 21:14:46.46 on Wed 09/23/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.520 [GMT -4:00]

AV: eTrust ITM *On-access scanning enabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe
C:\Program Files\CA\eTrustITM\InoRpc.exe
C:\Program Files\CA\eTrustITM\InoRT.exe
C:\Program Files\CA\eTrustITM\InoTask.exe
C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\eTrustITM\realmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Realtime Monitor] "c:\program files\ca\etrustitm\realmon.exe" -s
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [bubelasan] Rundll32.exe "c:\windows\system32\vahipoja.dll",a
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211479488573
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211481962415
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: lubefije.dll c:\windows\system32\vahipoja.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: OSDriver - {5447260E-F106-4857-A4CC-EB374FC6FF3A} - c:\documents and settings\all users\microsoft private data\microsoft\lan.dll
SSODL: SystemLoading - {E8A5853F-8B5C-43F6-8A52-A229C42BD00B} - c:\documents and settings\all users\microsoft private data\microsoft\rohrctwizi.dll
SSODL: dumubakak - {e490c2cd-900a-42a5-8d4a-0b9e20ddc7a5} - c:\windows\system32\vahipoja.dll
STS: kupuhivus: {e490c2cd-900a-42a5-8d4a-0b9e20ddc7a5} - c:\windows\system32\vahipoja.dll
LSA: Notification Packages = scecli zosusewa.dll

============= SERVICES / DRIVERS ===============

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-5-3 80384]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2004-9-2 32640]

=============== Created Last 30 ================

2009-09-23 20:47 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-09-23 20:47 <DIR> --dsh--- c:\documents and settings\administrator\IETldCache
2009-09-22 09:59 4,707 a------- C:\SafeBoot.zip
2009-09-22 07:52 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-09-22 07:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-09-18 11:59 410,984 a------- c:\windows\system32\deploytk.dll
2009-09-18 11:59 73,728 a------- c:\windows\system32\javacpl.cpl
2009-09-18 09:52 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-18 09:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-18 09:52 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-18 09:52 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-18 09:35 <DIR> --d----- c:\windows\pss
2009-09-18 09:23 0 a------- c:\windows\system32\41.exe
2009-09-08 10:00 <DIR> --d----- c:\program files\MSECache

==================== Find3M ====================

2009-09-22 07:46 87,552 a--sh--- c:\windows\system32\vahipoja.dll
2009-09-22 07:46 37,376 a--sh--- c:\windows\system32\nejoweyi.dll
2009-09-21 18:30 50,176 a--sh--- c:\windows\system32\dahovibo.dll
2009-09-21 18:29 88,576 a--sh--- c:\windows\system32\visegobu.dll
2009-09-21 18:29 37,888 a--sh--- c:\windows\system32\nuzepema.dll
2009-09-21 06:31 39,424 a--sh--- c:\windows\system32\yatodimi.dll
2009-09-18 09:29 39,424 a--sh--- c:\windows\system32\seduvumo.dll
2009-08-05 05:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-17 14:55 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll
2009-06-21 18:30 50,176 a--sh--- c:\windows\system32\lubefije.dll
2009-06-21 18:30 50,176 a--sh--- c:\windows\system32\vaditujo.dll
2009-06-21 18:30 50,176 a--sh--- c:\windows\system32\zosusewa.dll

============= FINISH: 21:15:48.29 ===============

Hello!
My name is Sam and I will be helping you.

In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.



Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


Make sure that you save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Hi Sam! Thank you very much for your assistance. Below is my ComboFix scan results. I tell you I'm perplexed at this thing. It is showing NO signs of being infected at the moment. The only thing apparent (aside from the crap in the scans that I remember) is the one entry in msconfig registering the vahipoja.dll. Looking forward to seeing how this has it's hooks in the system. . .

It has done this before and I thought I had it cleaned, only to have it come back full-blown the next day (after several hours of normal use!).



ComboFix 09-09-23.02 - Administrator 09/24/2009 20:01.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.623 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\Spyware Programs\ComboFix.exe
AV: eTrust ITM *On-access scanning enabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\WinRMSrv.msi
c:\windows\system32\41.exe
c:\windows\system32\lubefije.dll
c:\windows\system32\nejoweyi.dll
c:\windows\system32\nuzepema.dll
c:\windows\system32\seduvumo.dll
c:\windows\system32\yatodimi.dll
c:\windows\system32\zosusewa.dll

.
((((((((((((((((((((((((( Files Created from 2009-08-25 to 2009-09-25 )))))))))))))))))))))))))))))))
.

2009-09-24 01:46 . 2009-09-24 01:46 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-09-24 00:47 . 2009-09-24 00:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-24 00:47 . 2009-09-24 00:47 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-09-24 00:46 . 2009-09-24 00:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-09-24 00:46 . 2009-09-24 00:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-22 13:59 . 2009-09-22 13:59 4707 ----a-w- C:\SafeBoot.zip
2009-09-22 12:40 . 2009-09-22 12:40 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-22 11:52 . 2009-09-22 11:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-22 11:52 . 2009-09-22 11:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-18 16:01 . 2009-09-18 16:01 -------- d-----w- c:\documents and settings\pgardner\Application Data\Malwarebytes
2009-09-18 15:59 . 2009-09-18 15:59 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-09-18 15:56 . 2009-09-18 15:56 -------- d-----w- c:\documents and settings\khankins\Application Data\Research In Motion
2009-09-18 15:49 . 2009-09-18 15:49 -------- d-sh--w- c:\documents and settings\khankins\IECompatCache
2009-09-18 15:49 . 2009-09-18 15:49 -------- d-sh--w- c:\documents and settings\khankins\PrivacIE
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\documents and settings\khankins\Application Data\Malwarebytes
2009-09-18 13:52 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-18 13:52 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-08 14:00 . 2009-09-08 14:00 -------- d-----w- c:\program files\MSECache
2009-09-02 23:50 . 2009-09-02 23:50 -------- d-----w- c:\documents and settings\pgardner\Local Settings\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-24 00:47 . 2008-12-03 20:47 256 ----a-w- c:\windows\system32\pool.bin
2009-09-22 11:46 . 2009-06-22 11:46 87552 --sha-w- c:\windows\system32\vahipoja.dll
2009-09-21 22:30 . 2009-06-21 22:29 50176 --sha-w- c:\windows\system32\dahovibo.dll
2009-09-21 22:29 . 2009-06-21 22:29 88576 --sha-w- c:\windows\system32\visegobu.dll
2009-09-18 15:59 . 2008-05-22 16:51 -------- d-----w- c:\program files\Java
2009-09-10 07:09 . 2008-05-30 12:51 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 15:04 . 2008-07-01 15:30 85008 ----a-w- c:\documents and settings\pgardner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 20:19 . 2009-08-14 20:19 -------- d-----w- c:\program files\MSBuild
2009-08-14 20:19 . 2009-08-14 20:19 -------- d-----w- c:\program files\Reference Assemblies
2009-08-05 09:11 . 2006-02-28 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2006-02-28 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-21 10:32 . 2009-06-21 10:32 50688 --sha-w- c:\windows\system32\fufalovi.dll.tmp
2009-06-21 10:32 . 2009-06-21 10:32 50688 --sha-w- c:\windows\system32\sefoseyo.dll.tmp
2009-06-21 22:30 . 2009-06-21 22:30 50176 --sha-w- c:\windows\system32\vaditujo.dll
2009-06-21 10:32 . 2009-06-21 10:32 50688 --sha-w- c:\windows\system32\vuhuviti.dll.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f293410a-0526-43b0-bfc7-ce39e0c3f80c}]
2009-06-21 22:30 50176 --sha-w- c:\windows\system32\vaditujo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Realtime Monitor"="c:\program files\CA\eTrustITM\realmon.exe" [2007-01-17 407632]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-18 148888]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-21 155648]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-21 126976]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-11-19 233534]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"bubelasan"="c:\windows\system32\vahipoja.dll" [2009-09-22 87552]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-1-25 1447184]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{e490c2cd-900a-42a5-8d4a-0b9e20ddc7a5}"= "c:\windows\system32\vahipoja.dll" [2009-09-22 87552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"dumubakak"= {e490c2cd-900a-42a5-8d4a-0b9e20ddc7a5} - c:\windows\system32\vahipoja.dll [2009-09-22 87552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1129\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1130\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1254\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1258\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD Check.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [5/3/2004 12:26 PM 80384]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [9/2/2004 8:30 AM 32640]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:57]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-favisemavu - zosusewa.dll
SSODL-OSDriver-{5447260E-F106-4857-A4CC-EB374FC6FF3A} - c:\documents and settings\All Users\Microsoft Private Data\Microsoft\lan.dll
SSODL-SystemLoading-{E8A5853F-8B5C-43F6-8A52-A229C42BD00B} - c:\documents and settings\All Users\Microsoft Private Data\Microsoft\rohrctwizi.dll



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????"??|P????P???? ?4?B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,13,94,5b,9a,6f,89,aa,41,b8,97,88,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,13,94,5b,9a,6f,89,aa,41,b8,97,88,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(872)
c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll

- - - - - - - > 'explorer.exe'(2004)
c:\windows\system32\WININET.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll
c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll
c:\windows\system32\vahipoja.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\windows\system32\dla\tfswshx.dll
c:\windows\system32\tfswapi.dll
c:\windows\system32\dla\tfswcres.dll
c:\windows\system32\vaditujo.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\scardsvr.exe
c:\program files\CA\SharedComponents\iTechnology\igateway.exe
c:\program files\CA\eTrustITM\InoRPC.exe
c:\program files\CA\eTrustITM\InoRT.exe
c:\program files\CA\eTrustITM\InoTask.exe
c:\program files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CA\eTrustITM\Ppcl.exe
c:\program files\CA\eTrustITM\Ppcl.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\rundll32.exe
c:\program files\HPQ\Shared\hpqwmi.exe
c:\program files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
.
**************************************************************************
.
Completion time: 2009-09-25 20:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-25 00:12

Pre-Run: 46,815,268,864 bytes free
Post-Run: 47,151,538,176 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

228 --- E O F --- 2009-09-10 07:03

Edited by revDJkev, 24 September 2009 - 07:26 PM.

It's still hanging in there.

Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.

File::
c:\windows\system32\fufalovi.dll.tmp
c:\windows\system32\sefoseyo.dll.tmp
c:\windows\system32\vaditujo.dll
c:\windows\system32\vuhuviti.dll.tmp
c:\windows\system32\vahipoja.dll
c:\windows\system32\dahovibo.dll
c:\windows\system32\visegobu.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"dumubakak"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{e490c2cd-900a-42a5-8d4a-0b9e20ddc7a5}"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f293410a-0526-43b0-bfc7-ce39e0c3f80c}]

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

Prior to running Combofix.exe you should disable your antivirus program.

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.



This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.


=====================



Please update Malwarebytes and run a full scan.

• Open Malwarebytes and select the Update tab.
• Click on the Check for Updates button and allow the program to download the latest updates.
• Once you have the latest updates, select the Scanner tab.
• Select "Perform full scan" and click the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Sam,

Thanks for your help. I have had one issue I'm not sure if it affects what we are doing or not. When I run ComboFix, it is giving me a message that eTrust is still running. I have terminated everything in the task manager related to that, and disabled the services as well. I even went as far as to google all of the processes running that I did not know what they were. That being said, here is the contents of the scans.


ComboFix:

ComboFix 09-09-23.02 - Administrator 09/25/2009 13:42.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.688 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript
AV: eTrust ITM *On-access scanning enabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

FILE ::
"c:\windows\system32\dahovibo.dll"
"c:\windows\system32\fufalovi.dll.tmp"
"c:\windows\system32\sefoseyo.dll.tmp"
"c:\windows\system32\vaditujo.dll"
"c:\windows\system32\vahipoja.dll"
"c:\windows\system32\visegobu.dll"
"c:\windows\system32\vuhuviti.dll.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\dahovibo.dll
c:\windows\system32\fufalovi.dll.tmp
c:\windows\system32\sefoseyo.dll.tmp
c:\windows\system32\vaditujo.dll
c:\windows\system32\vahipoja.dll
c:\windows\system32\visegobu.dll
c:\windows\system32\vuhuviti.dll.tmp

.
((((((((((((((((((((((((( Files Created from 2009-08-25 to 2009-09-25 )))))))))))))))))))))))))))))))
.

2009-09-24 01:46 . 2009-09-24 01:46 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-09-24 00:47 . 2009-09-24 00:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-24 00:47 . 2009-09-24 00:47 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-09-24 00:46 . 2009-09-24 00:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-09-24 00:46 . 2009-09-24 00:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-22 13:59 . 2009-09-22 13:59 4707 ----a-w- C:\SafeBoot.zip
2009-09-22 12:40 . 2009-09-22 12:40 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-22 11:52 . 2009-09-22 11:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-22 11:52 . 2009-09-22 11:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-18 16:01 . 2009-09-18 16:01 -------- d-----w- c:\documents and settings\pgardner\Application Data\Malwarebytes
2009-09-18 15:59 . 2009-09-18 15:59 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-09-18 15:56 . 2009-09-18 15:56 -------- d-----w- c:\documents and settings\khankins\Application Data\Research In Motion
2009-09-18 15:49 . 2009-09-18 15:49 -------- d-sh--w- c:\documents and settings\khankins\IECompatCache
2009-09-18 15:49 . 2009-09-18 15:49 -------- d-sh--w- c:\documents and settings\khankins\PrivacIE
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\documents and settings\khankins\Application Data\Malwarebytes
2009-09-18 13:52 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-18 13:52 . 2009-09-18 13:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-18 13:52 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-08 14:00 . 2009-09-08 14:00 -------- d-----w- c:\program files\MSECache
2009-09-02 23:50 . 2009-09-02 23:50 -------- d-----w- c:\documents and settings\pgardner\Local Settings\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-25 17:40 . 2008-12-03 20:47 256 ----a-w- c:\windows\system32\pool.bin
2009-09-18 15:59 . 2008-05-22 16:51 -------- d-----w- c:\program files\Java
2009-09-10 07:09 . 2008-05-30 12:51 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 15:04 . 2008-07-01 15:30 85008 ----a-w- c:\documents and settings\pgardner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 20:19 . 2009-08-14 20:19 -------- d-----w- c:\program files\MSBuild
2009-08-14 20:19 . 2009-08-14 20:19 -------- d-----w- c:\program files\Reference Assemblies
2009-08-05 09:11 . 2006-02-28 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2006-02-28 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2006-02-28 12:00 915456 ------w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-18 148888]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-12-21 155648]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-12-21 126976]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-03 122939]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-11-19 233534]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-13 88209]
"favisemavu"="zosusewa.dll" [BU]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-1-25 1447184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1129\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1130\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1254\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1478543003-2407273631-488903073-1258\Scripts\Logon\0\0]
"Script"=\\THEIHSAA.local\NETLOGON\Login_Script.bat

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD Check.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [5/3/2004 12:26 PM 80384]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [9/2/2004 8:30 AM 32640]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 18:57]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-bubelasan - c:\windows\system32\vahipoja.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-25 13:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?8?4?4??????? ?4?B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,13,94,5b,9a,6f,89,aa,41,b8,97,88,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,13,94,5b,9a,6f,89,aa,41,b8,97,88,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2356)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\scardsvr.exe
c:\program files\CA\SharedComponents\iTechnology\igateway.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\HPQ\Shared\hpqwmi.exe
.
**************************************************************************
.
Completion time: 2009-09-25 13:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-25 17:54

Pre-Run: 47,181,037,568 bytes free
Post-Run: 47,143,088,128 bytes free

172 --- E O F --- 2009-09-10 07:03







Malwarebytes' Anti-Malware 1.41
Database version: 2819
Windows 5.1.2600 Service Pack 2

9/25/2009 3:03:36 PM
mbam-log-2009-09-25 (15-03-15).txt

Scan type: Full Scan (C:\|)
Objects scanned: 176178
Time elapsed: 26 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\favisemavu (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

No reason to be concerned about that message as long as Etrust does not interfere with Combofix. Your log looks pretty good to me. How are things on your end? Any problems?

Nope everything is golden! Thank you VERY much for your help.

A question if I may, can you point me in the right direction for where you learn how to tell what does not belong?? I'm very interested in learning the how's and why's of this stuff. . .

Thanks again,

Kevin

There's a great class right here at Bleeping Computer where you can learn everything you need to know to do battle with today's malware infections.
http://www.bleepingcomputer.com/forums/t/86678/malware-removal-training-program/



We need to remove Combofix now that we're done with it.

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
  
  
• 

==================



Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - You should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Excellent, thanks again!

I will be watching for a chance to sign up for the class too!




Kevin

Sounds good!

Now that your problem appears to be resolved, this thread will be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request.