Need help with an Autorun Virus (and possibly others)

I work at a Children’s home in Madagascar. My boss asked me to take a look at her (standalone) laptop (a Compaq Presario running Windows XP SP2)
because she was no longer able to run applications. She receives a message along the lines of “this operation has been cancelled due to restrictions enforced on your computer; contact your administrator” (apologies for the poor translation but she has a French language copy of Windows installed) whenever she tries to open an application.

She has an administrator account but appears to have lost her privilege to run applications (and also cmd, mmc, msconfig, gpedit, regedit etc). I also note that any Flash Drives/USB keys inserted into the pc have the following added to them:
-an autorun.inf file
-a folder named “docs” with a recycle bin icon

This happens whether the computer is started up in safe mode or not.

She had NO antivirus software installed (not entirely surprising then that she’s having virus issues). I installed the following tools (in this order) to try to kill the virus:

Malwarebytes Anti-Malware
SUPERAnti-Spyware
Spybot – Search and Destroy
SDFix

I ran full searches in safe mode using all of them whilst logged into the overall administrator account and deleted anything that they found. All of the above applications now show the PC as being clean.

As you can gather from the above, when running the overall administrator account in safe mode I am able to run applications (including regedit, msconfig etc). I have also checked c:\ and c:\system32 for suspicious hidden files but can’t see anything.

Despite this the problems described above (can’t run applications using my bosses administrator account, autorun.inf virus transferring itself onto any usb keys inserted) remain exactly the same.

Using the administrator account I’ve also tried to install and run Combofix, Avira and AVG 9. When I run the Combofix.exe file from my desktop then I receive a message which reads simply “error”. When I try to install AVG 9 then the installation procedure fails as soon as it attempts to create a registry entry (I guess either of these could be problems with the applications themselves – not necessarily malware). Avira also gives me an error message relating to a temp directory.

I’m relatively computer literate and have had some success in removing viruses from my own pc in the past but this one has really got me stumped. I’ve spent hours on this now and I thought it was time to ask the experts!!!!

If anyone can spare the time to take a look at this it would be very much appreciated.


DDS (Ver_09-12-01.01) - NTFSx86 MINIMAL
Run by Administrateur at 13:50:23,42 on 17/12/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.446.213 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Administrateur\Bureau\dds.scr

============== Pseudo HJT Report ===============

uStart Page = www.google.com
mURLSearchHooks: H - No File
mWinlogon: Taskman=c:\recycler\s-1-5-21-4512735870-8466410163-509615216-3231\yv8g67.exe
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
uRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uRunOnce: [RegistryDefrag Success Message] "c:\program files\tuneup utilities 2008\TUMessages.exe" /RegDefrag_Success
uRunOnce: [SpybotDeletingB4127] command.com /c del "c:\documents and settings\recup\reader_s.exe"
uRunOnce: [SpybotDeletingD3631] cmd.exe /c del "c:\documents and settings\recup\reader_s.exe"
mRun: [USB Antivirus] c:\program files\usb disk security\USBGuard.exe
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R1 fwdrv;Kerio Personal Firewall Driver;c:\windows\system32\drivers\FWDRV.SYS [2009-12-16 102912]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
S1 unpr;Unprotector;c:\windows\system32\drivers\unpr.sys [2009-12-6 4096]
S3 ALiIRDA;Pilote de périphérique infrarouge ALi;c:\windows\system32\drivers\alifir.sys [2009-5-4 26624]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]

=============== Created Last 30 ================

2009-12-17 10:34:01 0 d-----w- c:\docume~1\admini~1\applic~1\AVG8
2009-12-17 10:26:59 0 d-----w- C:\AVGTemp
2009-12-17 07:56:05 178176 ----a-w- c:\windows\system32\unrar.dll
2009-12-17 07:56:04 38 ----a-w- c:\windows\avisplitter.ini
2009-12-17 07:56:03 839680 ----a-w- c:\windows\system32\lameACM.acm
2009-12-17 07:56:03 414 ----a-w- c:\windows\system32\lame_acm.xml
2009-12-17 07:56:02 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2009-12-17 07:56:02 118784 ----a-w- c:\windows\system32\ac3acm.acm
2009-12-17 07:56:01 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-12-17 07:56:01 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2009-12-17 07:55:59 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-12-17 07:55:59 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2009-12-17 07:55:57 0 d-----w- c:\program files\K-Lite Codec Pack
2009-12-17 07:48:59 3272 ----a-w- c:\windows\system32\wbem\Outlook_01ca7eed6491d930.mof
2009-12-17 00:03:10 0 d-----w- c:\windows\SxsCaPendDel
2009-12-16 23:49:56 0 d-----w- c:\program files\iXi Tools
2009-12-16 23:49:18 0 d-----w- c:\program files\CCleaner
2009-12-16 21:35:43 0 d-----w- c:\windows\system32\wbem\Repository
2009-12-16 21:16:09 0 d-----w- c:\windows\ERUNT
2009-12-16 21:15:35 0 d-----w- C:\SDFix
2009-12-16 15:33:57 0 d-----w- c:\program files\Spybot - Search & Destroy
2009-12-16 15:33:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-12-16 09:49:44 0 d-----w- c:\docume~1\admini~1\applic~1\SUPERAntiSpyware.com
2009-12-16 09:41:11 8496 ----a-w- c:\windows\system32\qxzv85.exe@
2009-12-16 09:37:21 8496 ----a-w- c:\windows\system32\qxzv87.exe@
2009-12-16 09:23:42 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-12-16 09:23:24 0 d-----w- c:\program files\SUPERAntiSpyware
2009-12-16 08:42:20 102912 ------w- c:\windows\system32\drivers\FWDRV.SYS
2009-12-16 08:42:20 0 d-----w- c:\program files\Kerio
2009-12-16 08:01:14 34352 ----a-w- c:\windows\system32\gpedit.msc
2009-12-16 07:30:40 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-12-16 07:30:37 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-16 07:30:34 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-16 07:30:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-16 07:30:32 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-12-15 12:16:09 0 d-----w- c:\program files\USB Disk Security
2009-12-15 12:02:13 0 d-----w- c:\docume~1\admini~1\applic~1\TuneUp Software
2009-12-15 11:55:53 34352 ----a-w- c:\windows\gpedit.msc
2009-12-15 11:39:22 0 d-----w- C:\autorun.inf
2009-12-08 12:31:05 147616 -c--a-w- c:\windows\system32\dllcache\atapi.sys
2009-12-08 12:28:31 87040 ----a-w- c:\windows\system32\winint.exe
2009-12-08 11:39:23 306432 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-12-08 11:39:20 29440 ----a-w- c:\windows\system32\uxtuneup.dll
2009-12-08 11:39:00 0 d-----w- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-12-08 11:38:30 0 d-----w- c:\program files\TuneUp Utilities 2008
2009-12-08 11:36:33 0 d-----w- c:\program files\fichiers communs\Wise Installation Wizard
2009-12-08 07:32:28 103 ----a-w- c:\windows\WININIT.INI
2009-12-08 07:14:58 32768 ----a-w- c:\windows\system32\msncuxqg.dll
2009-12-06 12:34:28 132 ----a-w- c:\windows\system32\46.tmp
2009-12-06 12:21:39 0 ----a-w- C:\Con.@ Andrana @.386
2009-12-06 12:05:32 0 ----a-w- c:\windows\system32\43.tmp
2009-12-06 07:06:57 4096 ----a-w- c:\windows\system32\drivers\unpr.sys
2009-12-04 05:38:23 359040 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-01 12:20:15 0 ----a-w- c:\windows\system32\432.tmp
2009-12-01 11:13:26 0 ----a-w- c:\windows\system32\80.tmp
2009-12-01 05:48:12 4608 ----a-w- c:\windows\system32\drivers\ipsys.sys
2009-11-24 13:33:08 0 ----a-w- c:\windows\system32\B3.tmp
2009-11-24 13:26:26 0 ----a-w- c:\windows\system32\B0.tmp
2009-11-24 13:25:35 0 ----a-w- c:\windows\system32\AF.tmp
2009-11-24 13:25:21 116224 ----a-w- c:\windows\system32\AE.tmp
2009-11-24 13:25:15 28524 ----a-w- c:\windows\system32\AD.tmp
2009-11-24 13:24:25 31744 ----a-w- c:\windows\system32\AC.tmp
2009-11-24 13:21:09 212 ----a-w- c:\windows\system32\AB.tmp
2009-11-24 12:38:40 64512 ------w- c:\windows\system32\winssled.exe
2009-11-23 09:30:20 31744 ----a-w- c:\windows\system32\F3.tmp
2009-11-23 09:30:11 28524 ----a-w- c:\windows\system32\F1.tmp
2009-11-23 09:30:07 27648 ----a-w- c:\windows\system32\EF.tmp
2009-11-23 09:29:43 256 ----a-w- c:\windows\system32\DE.tmp
2009-11-19 17:44:16 0 d-----w- c:\program files\WolfPack

==================== Find3M ====================

2009-12-17 07:48:59 371070 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-17 07:48:58 49932 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-16 19:55:34 1056768 ----a-w- c:\windows\explorer(2).exe
2009-12-16 09:22:02 1056768 ----a-w- c:\windows\explorer.exe
2009-12-08 12:31:06 34816 ----a-w- c:\windows\system32\svchost.exe
2009-12-08 12:31:05 147616 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-06 07:09:06 359040 ----a-w- c:\windows\system32\drivers\TCPIP.SYS

============= FINISH: 13:50:47,46 ===============

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Due to the lack of feedback, this topic is now closed.
If you need this topic reopened, please PM a staff member and we will reopen it for you (include the address of this thread in your request). This applies to the original topic starter only. Everyone else with similar problems, please start a new topic.

Reopened by user request.

DDS Logs posted and attached as requested. Thanks again for taking a look at this.


DDS (Ver_09-12-01.01) - NTFSx86
Run by Admin 2 at 10:51:59,41 on 05/01/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.446.226 [GMT 3:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\NWDLS.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\USB Disk Security\USBGuard.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Admin 2\Bureau\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe"
mURLSearchHooks: H - No File
mWinlogon: Taskman=c:\recycler\s-1-5-21-4512735870-8466410163-509615216-3231\yv8g67.exe
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [USB Antivirus] c:\program files\usb disk security\USBGuard.exe
mRun: [AS00_Gear511] c:\program files\netgear\wg511scu\utility\Gear511.exe -hide
uExplorerRun: [userini] c:\windows\explorer.exe:userini.exe
IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admin2~1\applic~1\mozilla\firefox\profiles\7clvn1rc.default\

============= SERVICES / DRIVERS ===============

R1 fwdrv;Kerio Personal Firewall Driver;c:\windows\system32\drivers\FWDRV.SYS [2009-12-16 102912]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-11-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-11-23 74480]
R1 unpr;Unprotector;c:\windows\system32\drivers\unpr.sys [2009-12-6 4096]
R3 AWINDIS5;AWINDIS5 Protocol Driver;c:\windows\system32\AWINDIS5.SYS [2009-12-17 16194]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-11-23 7408]
S3 ALiIRDA;Pilote de périphérique infrarouge ALi;c:\windows\system32\drivers\alifir.sys [2009-5-4 26624]
S3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;c:\windows\system32\drivers\wg511nd5.sys [2009-12-17 488992]

=============== Created Last 30 ================

2009-12-17 12:23:52 70216 ------w- c:\windows\system32\NWDLS.exe
2009-12-17 12:23:52 65448 ------w- c:\windows\system32\installservice.exe
2009-12-17 12:23:52 45056 ------w- c:\windows\system32\kill.dll
2009-12-17 12:23:38 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-12-17 12:23:28 241664 ----a-w- c:\windows\Unin511T.exe
2009-12-17 12:23:28 241664 ----a-w- c:\windows\Inst511T.exe
2009-12-17 12:23:27 73728 ----a-w- c:\windows\system32\AW32n50.dll
2009-12-17 12:23:27 17801 ----a-w- c:\windows\system32\AegisP.sys
2009-12-17 12:23:27 16194 ----a-w- c:\windows\system32\AWINDIS5.SYS
2009-12-17 12:23:26 488992 ----a-w- c:\windows\system32\drivers\wg511nd5.sys
2009-12-17 12:23:24 0 d-----w- c:\program files\NETGEAR
2009-12-17 10:26:59 0 d-----w- C:\AVGTemp
2009-12-17 07:56:05 178176 ----a-w- c:\windows\system32\unrar.dll
2009-12-17 07:56:04 38 ----a-w- c:\windows\avisplitter.ini
2009-12-17 07:56:03 839680 ----a-w- c:\windows\system32\lameACM.acm
2009-12-17 07:56:03 414 ----a-w- c:\windows\system32\lame_acm.xml
2009-12-17 07:56:02 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2009-12-17 07:56:02 118784 ----a-w- c:\windows\system32\ac3acm.acm
2009-12-17 07:56:01 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-12-17 07:56:01 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2009-12-17 07:55:59 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-12-17 07:55:59 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2009-12-17 07:55:57 0 d-----w- c:\program files\K-Lite Codec Pack
2009-12-17 07:52:16 0 d-----w- c:\docume~1\admin2~1\applic~1\COWON
2009-12-17 07:48:59 3272 ----a-w- c:\windows\system32\wbem\Outlook_01ca7eed6491d930.mof
2009-12-17 00:03:10 0 d-----w- c:\windows\SxsCaPendDel
2009-12-16 23:50:19 0 d-----w- c:\docume~1\admin2~1\applic~1\TuneUp Software
2009-12-16 23:49:56 0 d-----w- c:\program files\iXi Tools
2009-12-16 23:49:18 0 d-----w- c:\program files\CCleaner
2009-12-16 23:49:18 0 d-----w- c:\docume~1\admin2~1\applic~1\Malwarebytes
2009-12-16 21:35:43 0 d-----w- c:\windows\system32\wbem\Repository
2009-12-16 21:16:09 0 d-----w- c:\windows\ERUNT
2009-12-16 21:15:35 0 d-----w- C:\SDFix
2009-12-16 15:33:57 0 d-----w- c:\program files\Spybot - Search & Destroy
2009-12-16 15:33:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-12-16 15:01:56 0 d-s---w- c:\documents and settings\admin 2\UserData
2009-12-16 09:41:11 8496 ----a-w- c:\windows\system32\qxzv85.exe@
2009-12-16 09:37:21 8496 ----a-w- c:\windows\system32\qxzv87.exe@
2009-12-16 09:36:11 0 d-----w- c:\docume~1\admin2~1\applic~1\AVG8
2009-12-16 09:23:42 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-12-16 09:23:24 0 d-----w- c:\program files\SUPERAntiSpyware
2009-12-16 09:23:24 0 d-----w- c:\docume~1\admin2~1\applic~1\SUPERAntiSpyware.com
2009-12-16 08:42:20 102912 ------w- c:\windows\system32\drivers\FWDRV.SYS
2009-12-16 08:42:20 0 d-----w- c:\program files\Kerio
2009-12-16 08:01:14 34352 ----a-w- c:\windows\system32\gpedit.msc
2009-12-16 07:30:37 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-16 07:30:34 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-16 07:30:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-16 07:30:32 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-12-15 12:16:09 0 d-----w- c:\program files\USB Disk Security
2009-12-15 11:55:53 34352 ----a-w- c:\windows\gpedit.msc
2009-12-15 11:39:22 0 d-----w- C:\autorun.inf
2009-12-08 12:31:05 147616 -c--a-w- c:\windows\system32\dllcache\atapi.sys
2009-12-08 12:28:31 87040 ----a-w- c:\windows\system32\winint.exe
2009-12-08 11:39:23 306432 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-12-08 11:39:20 29440 ----a-w- c:\windows\system32\uxtuneup.dll
2009-12-08 11:39:00 0 d-----w- c:\docume~1\alluse~1\applic~1\TuneUp Software
2009-12-08 11:38:30 0 d-----w- c:\program files\TuneUp Utilities 2008
2009-12-08 11:36:33 0 d-----w- c:\program files\fichiers communs\Wise Installation Wizard
2009-12-08 07:32:28 103 ----a-w- c:\windows\WININIT.INI
2009-12-08 07:14:58 32768 ----a-w- c:\windows\system32\msncuxqg.dll
2009-12-06 12:34:28 132 ----a-w- c:\windows\system32\46.tmp
2009-12-06 12:21:39 0 ----a-w- C:\Con.@ Andrana @.386
2009-12-06 12:05:32 0 ----a-w- c:\windows\system32\43.tmp

==================== Find3M ====================

2009-12-17 12:44:02 49932 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-17 12:44:02 371070 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-16 19:55:34 1056768 ----a-w- c:\windows\explorer(2).exe
2009-12-16 09:22:02 4608 ----a-w- c:\windows\system32\drivers\ipsys.sys
2009-12-16 09:22:02 1056768 ----a-w- c:\windows\explorer.exe
2009-12-08 12:31:06 34816 ----a-w- c:\windows\system32\svchost.exe
2009-12-08 12:31:05 147616 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-08 07:06:11 4096 ----a-w- c:\windows\system32\drivers\unpr.sys
2009-12-06 07:09:06 359040 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-12-04 05:38:23 359040 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-11-24 13:25:34 116224 ----a-w- c:\windows\system32\AE.tmp
2009-11-24 13:25:21 28524 ----a-w- c:\windows\system32\AD.tmp
2009-11-24 13:25:15 31744 ----a-w- c:\windows\system32\AC.tmp
2009-11-24 12:38:37 64512 ------w- c:\windows\system32\winssled.exe
2009-11-23 09:30:22 31744 ----a-w- c:\windows\system32\F3.tmp
2009-11-23 09:30:16 28524 ----a-w- c:\windows\system32\F1.tmp
2009-11-23 09:30:11 27648 ----a-w- c:\windows\system32\EF.tmp

============= FINISH: 10:52:07,62 ===============

Hello, Boggleboy73 and again
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:

• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
• Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
• Please set your system to show all files.
  Click Start, open My Computer, select the Tools menu and click Folder Options.
  Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
  Uncheck: Hide file extensions for known file types
  Uncheck the Hide protected operating system files (recommended) option.
  Click Yes to confirm.

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

Hi Tom

Ran gmer (pc in safe mode) this afternoon and the log is below.

Thanks again for your help - really appreciated.

Simon

----------------------------------------

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-06 20:02:11
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxnyqfoc.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\Drivers\fwdrv.sys ZwClose [0xF7141D1E]
SSDT \SystemRoot\system32\Drivers\fwdrv.sys ZwCreateFile [0xF714162B]
SSDT sprm.sys ZwCreateKey [0xF742F0E0]
SSDT \SystemRoot\system32\Drivers\fwdrv.sys ZwCreateProcess [0xF7141C92]
SSDT \SystemRoot\system32\Drivers\fwdrv.sys ZwCreateProcessEx [0xF7141C17]
SSDT \SystemRoot\system32\Drivers\fwdrv.sys ZwCreateSection [0xF7141713]
SSDT sprm.sys ZwEnumerateKey [0xF744DCA2]
SSDT sprm.sys ZwEnumerateValueKey [0xF744E030]
SSDT sprm.sys ZwOpenKey [0xF742F0C0]
SSDT sprm.sys ZwQueryKey [0xF744E108]
SSDT sprm.sys ZwQueryValueKey [0xF744DF88]
SSDT sprm.sys ZwSetValueKey [0xF744E19A]

INT 0x3A ? 84251BF8

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + E3 804E2DB4 1 Byte [2B]
.text ntoskrnl.exe!_abnormal_termination + F3 804E2DC4 1 Byte [E0]
? sprm.sys Le fichier spécifié est introuvable. !
.text USBPORT.SYS!DllUnload F71F262C 5 Bytes JMP 842511D8

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\system32\winlogon.exe[212] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\system32\services.exe[256] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FF9491A
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FF949A9
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FF949B6
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FF94C3A
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FF9499F
.text C:\WINDOWS\system32\lsass.exe[268] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FF949F7
.text C:\WINDOWS\system32\svchost.exe[416] C:\WINDOWS\system32\svchost.exe section is writeable [0x01001000, 0x2C00, 0xE0000020]
.rsrc C:\WINDOWS\system32\svchost.exe[416] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x5600, 0xE0000040]
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\system32\svchost.exe[416] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\WINDOWS\system32\svchost.exe[488] C:\WINDOWS\system32\svchost.exe section is writeable [0x01001000, 0x2C00, 0xE0000020]
.rsrc C:\WINDOWS\system32\svchost.exe[488] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x5600, 0xE0000040]
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\system32\svchost.exe[488] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\WINDOWS\system32\svchost.exe[528] C:\WINDOWS\system32\svchost.exe section is writeable [0x01001000, 0x2C00, 0xE0000020]
.rsrc C:\WINDOWS\system32\svchost.exe[528] C:\WINDOWS\system32\svchost.exe section is executable [0x01005000, 0x5600, 0xE0000040]
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\system32\svchost.exe[528] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\WINDOWS\Explorer.EXE[744] Explorer.EXE 0101E26B 4 Bytes [FF, 15, 98, 10]
.text C:\WINDOWS\Explorer.EXE[744] C:\WINDOWS\Explorer.EXE section is writeable [0x01001000, 0x44689, 0xE0000020]
.reloc C:\WINDOWS\Explorer.EXE[744] C:\WINDOWS\Explorer.EXE section is executable [0x010FC000, 0x8800, 0xE0000040]
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtCreateFile 7C91D682 5 Bytes CALL 7FFA491A
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtCreateProcess 7C91D754 5 Bytes CALL 7FFA49A9
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtCreateProcessEx 7C91D769 5 Bytes CALL 7FFA49B6
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtDeviceIoControlFile 7C91D8E3 5 Bytes CALL 7FFA4C3A
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtOpenFile 7C91DCFD 5 Bytes CALL 7FFA499F
.text C:\Documents and Settings\Administrateur\Bureau\gmer.exe[928] ntdll.dll!NtQueryInformationProcess 7C91E01B 5 Bytes CALL 7FFA49F7

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 843E22D8
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F7460C4C] sprm.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7460CA0] sprm.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 842512D8
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7440048] sprm.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 843721F8
Device \Driver\usbohci \Device\USBPDO-0 842501F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 843E01F8
Device \Driver\Cdrom \Device\CdRom0 842411F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 843731F8
Device \Driver\atapi \Device\Ide\IdePort0 843731F8
Device \Driver\atapi \Device\Ide\IdePort1 843731F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 843731F8
Device \Driver\usbohci \Device\USBFDO-0 842501F8
Device \Driver\Ftdisk \Device\FtControl 843E01F8
Device \FileSystem\Cdfs \Cdfs 841034D8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x67 0x9D 0x57 0xF0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB0 0x7E 0xF0 0x75 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x20 0x93 0x66 0xC8 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x67 0x9D 0x57 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB0 0x7E 0xF0 0x75 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x20 0x93 0x66 0xC8 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs C:\WINDOWS\system32\curslib.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs 1

---- Files - GMER 1.0.15 ----

ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP99\A0024322.exe:userini.exe 104953 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP99\A0024332.exe:userini.exe 104953 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP99\A0024384.exe:userini.exe 104953 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP99\A0025408.exe:userini.exe 104953 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP107\A0027173.exe:ext.exe 63488 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP110\A0030296.exe:ext.exe 64000 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP110\A0030307.exe:userini.exe 104953 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP114\A0033843.exe:userini.exe 122420 bytes executable
ADS C:\System Volume Information\_restore{8344D17A-9DF2-494F-8324-1ACD7E03D5FB}\RP115\A0034099.exe:userini.exe 122420 bytes executable
ADS C:\WINDOWS\explorer(2).exe:userini.exe 122420 bytes executable

---- EOF - GMER 1.0.15 ----

Hi,

Please plug in every external media and let them in until I give you the all clean.



Please download Flash_Disinfector.exe by sUBs and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
• Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.






Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

• When finished, it will produce a report for you.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Hi Tom

I downloaded and ran Flash Disinfector successfully as instructed.

Next I downloaded Combofix from bleepingcomputer. I renamed the file and placed it on the desktop as instructed. I also disabled all security programs.

When I run the renamed combofix file I receive the following error message (the text of the message was in French but I've done my best to translate):

"Warning - it is dangerous to continue. The contents of the combofix package have been damaged. PLease download a new version from www.bleepingcomputer.com/combofix/how to use combofix.
Note - your PC may be infected with a virus which modifies files "virut"."

The renamed combofix.exe file is then automatically deleted.

I have downloaded and renamed new versions of the combofix.exe file from both link sites you receommended several times but always have the same problem.

I've also tried running them in safe mode - same result.

Please let me know what you would like me to do next.

Many thanks

Simon

Hi,

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link-->Jotti

When the jotti page has finished loading, click the browse button and navigate to the files listed below in bold, then click Submit. You will only be able to have one file scanned at a time.

c:\windows\system32\svchost.exe
c:\windows\explorer.exe


Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

Hi Tom

I tried to follow these steps but unfortunately I think the viruses are one step ahead of us.

I connected to the internet on the infected PC and was able to successfully view sites such as google, msn, facebook etc. However when I tried to go to http://virusscan.jotti.org/ or http://www.virustotal.com/ I received a "page cannot be found" error. Perhaps the virus is preventing the web browser from connecting to these pages as I tried several other sites afterwards and had no problems.

I tried to work around the problem by copying the svchost.exe and explorer.exe files to a flash-drive and using a different PC to connect to http://virusscan.jotti.org/ . This worked fine until I instructed the page to start scanning the svchost.exe file on the flash-disk. At this point the AVG software on the computer identified the svchost.exe file on the flashdisk as having a virus. The same happened with the explorer.exe file.

It looks to me like both svchost and explorer.exe on the problem computer are infected - but any idea how to fix them?

Let me know what you'd like to try next.

Thanks for persevering with this!!

Can you zip those files and upload?

Then please visit this site

http://www.bleepingcomputer.com/submit-mal....php?channel=93

and upload the files.

Hi Tom

I just uploaded the svchost.exe and explorer.exe files to the page requested.

Incidentally the avg installation on my pc identified them as being infected with: Win32/Virut when I began uploading them

Thanks again

Simon

Hi,


I'm afraid I have very bad news.

Your system is infected with a nasty variant of Virut, a polymorphic file infector with IRCBot functionality which infects .exe, .scr files, downloads more malicious files to your system, and opens a back door that compromises your computer. According to this Norman White Paper Assessment of W32/Virut, some variants can infect the HOSTS file and block access to security related web sites. Other variants of virut can even penetrate and infect .exe files within compressed files (.zip, .cab, rar). Virux is an even more complex file infector which can embed an iframe into the body of web-related files and infect script files (.php, .asp, .htm, .html, .xml). When Virut creates infected files, it also creates non-functional files that are corrupted beyond repair and in some instances can disable Windows File Protection. In many cases the infected files cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files become corrupted and the system may become irreparable. The longer virut remains on a computer, the more critical system files will become infected and corrupt so the degree of infection can vary.

The virus disables Windows File Protection by injecting code into the "winlogon.exe" process that patches system code in memory.

CA Virus detail of W32/Virut

The virus has a number of bugs in its code, and as a result it may misinfect a proportion of executable files....some W32/Virut.h infections are corrupted beyond repair.

McAfee Risk Assessment and Overview of W32/Virut

There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus...Due to the damaged caused to files by virut it's possible to find repaired but corrupted files. They became corrupted by the incorrect writing of the viral code during the process of infection. undetected, corrupted files (possibly still containing part of the viral code) can also be found. this is caused by incorrectly written and non-function viral code present in these files.

AVG Overview of W32/Virut

• miekiemoes' Blog on Virut.
• Virut and other File infectors - Throwing in the Towel?

This kind of infection is contracted and spread by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and an increasing source of system infection. However, the CA Security Advisor Research Blog says they have found MySpace user pages carrying the malicious Virut URL. Either way you can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

If your computer was used for online banking, has credit card information or other sensitive data on it, you should disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. You should change each password using a clean computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read:

• How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
• What Should I Do If I've Become A Victim Of Identity Theft?
• Identity Theft Victims Guide - What to do

Virut is not effectively disinfectable. Your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. In many cases the infected files cannot be deleted and anti-malware scanners cannot disinfect them properly. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Reinstalling Windows without first wiping the entire hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Please read:

• When should I re-format? How should I reinstall?
• Help: I Got Hacked. Now What Do I Do?
• Where to draw the line? When to recommend a format and reinstall?

Hi Tom

Thanks for your help. Even if the news isn't good.

It looks like you (and the othetr sites you link to) are suggesting that a complete reformat is the only way to be sure of removing the virus. I have two questions for you:

1) If I do go down the rought of formatting the drives and reinstalling windows then of course I'd like to back up the contents of "my documents" and the restore them once the reinstall is complete. Is there any risk of reintroducing the virus by doing this? I assume that the virus resides in files necessary for Windows to operate and not in areas used for general data storage. Do you have any advice?

2) Before i go ahead with the format and reinstallation, is there anything else that I can try?

Either way I'd like to thank you for your courtesy, prompt advice and patience in helping me to analyse the problem. It's great to receive such professional service for free!!!

Simon