after a small fight and the help of a blackberry with internet i managed to get spybot S&D on the machine which (so i thought) cleared everything out, it said it was opachki.ru
i then remembered that my f-secure trial had expired and realised that must be how it got in, so i downloaded vipre from sunbelt software (antivir and antispyware together) on a trial (as the firewall isnt win7 compat yet) with aim to upgrade to full in the new year.
it detected many viruses, win32.cryptor being the most common, it removed most, i ran (probably a botched) assault on these virii with root repeal, GMER, combofix, win32diag and exehelper.
all my programs were now calling no longer present virii files calc.dll being the most common, so i went into safemode and ran a few more scans and finally got rid (so i thought) of everything
something is still there, though vipre is locking it down, it keeps trying to run programs by activating xyz123.tmp or xyz123.dll or xyz123.exe (random filenames) all being called by svchost.dll or other system processes.
it is at this point that i turn to you oh fountains of knowledge as i need help. dds logs attached and i await your (hopefully prompt) response.
root repeal gives the following error on launch
"FOPS - DeviceIoControl Error! Error Code = 0xc0000024
Extended info (0x00000ec)"
same error on clicking scan
dds log as follows attach log is zipped and ... attached.
DDS (Ver_09-12-01.01) - NTFSx86
Run by dave at 21:10:31.43 on 10/12/2009
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.44.1033.18.1015.324 [GMT 0:00]
SP: Antispyware *disabled* (Updated) {888B6F93-C965-465D-B71D-70030A09481F}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\explorer.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Users\dave\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.co.uk/
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Shell=Explorer.exe rundll32.exe pnde.beo ajhcua
BHO: c:\windows\system32\yhe7o3qx.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\yhe7o3qx.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [notepad] rundll32.exe c:\windows\system32\config\system~1\ntload.dll,_IWMPEvents@0
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SBAMTray] c:\program files\sunbelt software\vipre\SBAMTray.exe
mRun: [notepad] rundll32.exe c:\windows\system32\notepad.dll,_IWMPEvents@0
mRun: [SBRegRebootCleaner] c:\program files\sunbelt software\vipre\SBRC.exe
StartupFolder: c:\users\dave\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Notify: igfxcui - igfxdev.dll
STS: c:\windows\system32\yhe7o3qx.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\yhe7o3qx.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\users\dave\appdata\roaming\mozilla\firefox\profiles\7mu47eyl.default\
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-10-13 95024]
R1 sbtis;sbtis;c:\windows\system32\drivers\sbtis.sys [2009-12-8 203056]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 SBAMSvc;VIPRE Antivirus + Antispyware;c:\program files\sunbelt software\vipre\SBAMSvc.exe [2009-10-27 1012080]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2009-8-10 69936]
S3 {6178CBD2-8F3D-465F-9C9D8B75082E22B9};{6178CBD2-8F3D-465F-9C9D8B75082E22B9};c:\windows\system32\svchost.exe -k netsvcs [2009-7-13 20992]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
=============== Created Last 30 ================
2009-12-10 20:53:56 0 d-----w- c:\program files\Trend Micro
2009-12-10 20:49:55 104 ----a-w- c:\windows\system32\SBRC.dat
2009-12-10 20:39:31 46 ----a-w- C:\p2hhr.bat
2009-12-10 20:39:14 25601 ----a-w- c:\windows\system32\pnde.beo
2009-12-10 20:39:14 15000 ------w- c:\windows\system32\yhe7o3qx.dll
2009-12-09 03:00:51 0 d-----w- c:\program files\MSXML 4.0
2009-12-08 20:43:20 0 d-----w- c:\programdata\Google
2009-12-08 03:42:33 0 d-----w- c:\users\dave\Tracing
2009-12-08 03:41:52 0 d-----w- c:\program files\Microsoft
2009-12-08 03:41:31 0 d-----w- c:\program files\Windows Live SkyDrive
2009-12-08 03:40:38 0 d-----w- c:\windows\PCHEALTH
2009-12-08 03:38:10 0 d-----w- c:\program files\common files\Windows Live
2009-12-08 00:34:28 0 d-----w- c:\programdata\Sunbelt
2009-12-08 00:34:27 0 d-----w- c:\users\dave\appdata\roaming\Sunbelt
2009-12-08 00:33:43 203056 ----a-w- c:\windows\system32\drivers\sbtis.sys
2009-12-08 00:33:25 0 d-----w- c:\program files\Sunbelt Software
2009-12-07 23:39:04 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-12-07 23:00:44 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-12-07 02:56:15 0 d-----w- c:\program files\F-Secure
2009-12-07 02:55:34 0 d-----w- c:\programdata\fssg
2009-12-07 02:54:15 0 d-----w- c:\programdata\f-secure
2009-12-07 02:37:35 0 d-sh--w- C:\$RECYCLE.BIN
2009-12-07 02:24:56 98816 ----a-w- c:\windows\sed.exe
2009-12-07 02:24:56 77312 ----a-w- c:\windows\MBR.exe
2009-12-07 02:24:56 260608 ----a-w- c:\windows\PEV.exe
2009-12-07 02:24:56 161792 ----a-w- c:\windows\SWREG.exe
2009-12-07 02:15:57 91904 ----a-w- C:\kwlyipow.sys
2009-12-07 01:26:48 0 d-sh--w- c:\windows\system32\%APPDATA%
2009-12-06 01:39:04 215 ----a-w- c:\windows\wininit.ini
2009-12-06 01:06:05 0 d-----w- c:\programdata\Spybot - Search & Destroy
2009-12-06 01:06:05 0 d-----w- c:\program files\Spybot - Search & Destroy
2009-12-06 00:30:18 0 d-----w- c:\windows\system32\appmgmt
2009-12-01 01:57:40 0 d-----w- c:\programdata\Adobe
2009-11-29 22:56:00 0 d-----w- c:\program files\mackoy
2009-11-27 16:43:17 17408 ---ha-w- c:\windows\BIT8735.tmp
2009-11-27 05:01:03 0 d-----w- c:\program files\GoldWave
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITF260.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITEFD6.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BITAB64.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT95B5.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT69F.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT5640.tmp
2009-11-25 20:03:25 17408 ---ha-w- c:\windows\BIT4D1E.tmp
2009-11-25 03:00:46 2048 ----a-w- c:\windows\system32\tzres.dll
2009-11-23 19:41:03 65536 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TM.blf
2009-11-23 19:41:03 524288 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TMContainer00000000000000000002.regtrans-ms
2009-11-23 19:41:03 524288 --sha-w- c:\users\dave\NTUSER.DAT{155a6f1f-d868-11de-95c1-00235471122e}.TMContainer00000000000000000001.regtrans-ms
2009-11-22 22:29:38 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2009-11-22 22:29:37 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2009-11-22 22:29:37 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-11-22 22:29:37 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-11-22 22:29:14 0 d-----w- c:\program files\TVersity Codec Pack
2009-11-22 22:28:56 0 d-----w- c:\program files\TVersity
2009-11-22 22:27:47 6144 ----a-w- c:\windows\system32\ff_acm.acm
2009-11-22 22:27:46 7680 ----a-w- c:\windows\system32\ff_vfw.dll
2009-11-22 22:27:43 0 d-----w- c:\program files\ffdshow
2009-11-20 16:29:37 0 d-----w- c:\program files\LucasArts
2009-11-20 14:51:57 47616 ----a-w- c:\windows\wupd.dll
2009-11-18 18:54:24 0 d-----w- c:\users\dave\appdata\roaming\OpenOffice.org
2009-11-18 18:44:58 0 d-----w- c:\program files\OpenOffice.org 3
2009-11-11 19:44:33 0 d-----w- c:\users\dave\appdata\roaming\Spotify
2009-11-11 19:44:26 0 d-----w- c:\program files\Spotify
==================== Find3M ====================
2009-11-10 14:21:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2009-11-05 04:55:17 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-04 17:00:56 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-27 14:31:16 27984 ----a-w- c:\windows\system32\sbbd.exe
2009-10-13 09:22:50 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:15:35 28160 --sha-w- c:\windows\system32\notepad.dll
2009-07-14 01:15:35 28160 --sha-w- c:\windows\system32\config\systemprofile\ntload.dll
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
============= FINISH: 21:11:33.57 ===============