Still can't remove trojans after safe mode antivirus scan [CLOSED]

Hello

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.



Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.




Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

doing a online scan right now.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:54 AM, on 21/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.tpg.com.au:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.1;192.168.0.2;192.168.1.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [380c46ea] rundll32.exe "C:\WINDOWS\system32\ervoodfo.dll",b
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BM3b3f7576] Rundll32.exe "C:\WINDOWS\system32\cltdokkc.dll",s
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{990708A9-3327-401D-9890-C7B14E3A01EC}: NameServer = 192.168.0.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: opnlLBTm - opnlLBTm.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8526 bytes





ComboFix 08-06-20.1 - Nofearr 2008-06-21 10:55:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1408 [GMT 10:00]
Running from: C:\Documents and Settings\Nofearr\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM3b3f7576.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ckwrqcpd.ini
C:\WINDOWS\system32\kcehakkw.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ofdoovre.ini
C:\WINDOWS\system32\prkuxjrt.ini
C:\WINDOWS\system32\qkiocvgq.ini
C:\WINDOWS\system32\ruBHQqru.ini
C:\WINDOWS\system32\ruBHQqru.ini2
C:\WINDOWS\system32\urqQHBur.dll
I:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.

2008-06-20 23:05 . 2008-06-21 10:24 121 --a------ C:\WINDOWS\bdagent.INI
2008-06-20 22:50 . 2008-06-21 10:21 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-06-20 22:48 . 2008-06-20 22:49 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-06-20 22:48 . 2008-06-21 10:25 <DIR> d-------- C:\Program Files\BitDefender
2008-06-20 19:03 . 2008-06-20 19:04 79,360 --a------ C:\WINDOWS\system32\ervoodfo.dll
2008-06-20 19:00 . 2008-06-20 19:00 90,112 --a------ C:\WINDOWS\system32\cltdokkc.dll
2008-06-20 18:58 . 2008-06-20 18:58 90,112 --a------ C:\WINDOWS\system32\ucbyptcr.dll
2008-06-19 20:38 . 2008-06-19 20:38 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-19 20:24 . 2008-06-19 20:27 <DIR> d-------- C:\Documents and Settings\Nofearr\Application Data\MailFrontier
2008-06-19 20:18 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-06-19 19:36 . 2008-06-19 19:36 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-19 19:22 . 2008-06-19 19:22 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-19 19:08 . 2008-06-21 11:05 6,327,584 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-19 19:08 . 2008-06-21 11:00 86,648 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-19 02:33 . 2008-06-19 02:33 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-06-19 02:16 . 2008-06-19 02:16 <DIR> d-------- C:\Program Files\AVG
2008-06-19 02:16 . 2008-06-19 09:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-17 22:18 . 2008-06-17 22:18 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-17 22:18 . 2008-06-17 22:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-17 22:16 . 2008-06-17 22:16 90,112 --a------ C:\WINDOWS\system32\bajqvskb.dll.vzr
2008-06-17 22:16 . 2008-06-17 22:16 80,896 --a------ C:\WINDOWS\system32\trjxukrp.dll.vzr
2008-06-16 22:52 . 2008-06-16 22:52 51,355 --a------ C:\WINDOWS\system32\muzika.xm
2008-06-15 17:16 . 2008-06-20 22:12 <DIR> d-------- C:\Documents and Settings\Nofearr\Application Data\IBP
2008-06-11 12:54 . 2008-04-14 21:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 12:54 . 2008-04-14 21:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 20:15 . 2008-06-07 14:36 <DIR> d-------- C:\Documents and Settings\Nofearr\Application Data\Canon
2008-05-31 20:15 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-05-31 20:15 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-05-31 20:14 . 2008-05-31 20:14 <DIR> d-------- C:\Program Files\Canon
2008-05-31 20:02 . 2002-05-24 03:04 389,180 --a------ C:\WINDOWS\system32\UCS32P.DLL
2008-05-31 20:02 . 2003-09-17 17:35 339,968 --a------ C:\WINDOWS\system32\N067UFW.DLL
2008-05-31 20:02 . 2002-09-12 01:07 36,864 --a------ C:\WINDOWS\system32\CNQU70.DLL
2008-05-23 08:22 . 2008-05-23 08:22 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2008-05-23 08:20 . 2008-05-23 08:20 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-05-23 08:20 . 2008-05-23 08:20 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-05-23 08:19 . 2008-05-23 08:19 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2008-05-23 08:19 . 2008-05-23 08:19 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-05-23 08:19 . 2008-05-23 08:19 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2008-05-23 08:19 . 2008-05-23 08:19 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest
2008-05-23 08:19 . 2008-05-23 08:19 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest
2008-05-23 08:18 . 2008-05-23 08:18 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 07:41 --------- d-----w C:\Program Files\DYMO Label
2008-06-17 12:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-08 04:43 --------- d-----w C:\Program Files\DivX
2008-06-02 12:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-31 10:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-17 14:32 --------- d-----w C:\Documents and Settings\Nofearr\Application Data\Ventrilo
2008-05-14 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-09 16:48 --------- d-----w C:\Program Files\FlashGet
2008-05-09 09:54 --------- d-----w C:\Documents and Settings\Nofearr\Application Data\skypePM
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-29 01:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 01:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 01:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-23 10:22 --------- d-----w C:\Program Files\Pennytel
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-10 15:35 68856]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 10:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 17:56 15360]
"IBP"="" []
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 12:32 94208]
"WeatherWatcher"="C:\Program Files\Weather Watcher\ww.exe" [2008-01-22 21:18 1028096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 C:\WINDOWS\SkyTel.exe]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2004-03-18 08:33 892928]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22 86016]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 06:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-06-15 11:36 229376]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"RegistryMechanic"="" []
"380c46ea"="C:\WINDOWS\system32\ervoodfo.dll" [2008-06-20 19:04 79360]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"BM3b3f7576"="C:\WINDOWS\system32\cltdokkc.dll" [2008-06-20 19:00 90112]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 17:56 15360]

C:\Documents and Settings\Nofearr\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 18:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 14:40:46 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnlLBTm]
opnlLBTm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
PCANotify.dll 2001-11-02 09:50 24636 C:\WINDOWS\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\IBP 9\\IBP.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Symantec\\pcAnywhere\\WINAW32.EXE"=
"C:\\Program Files\\Symantec\\pcAnywhere\\AWHOST32.EXE"=
"C:\\Program Files\\Symantec\\pcAnywhere\\awrem32.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - wd_windows_tools\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-06-20 05:58:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 11:05:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\ervoodfo.dll
-> C:\WINDOWS\system32\cltdokkc.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\searchindexer.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2008-06-21 11:08:34 - machine was rebooted [Nofearr]
ComboFix-quarantined-files.txt 2008-06-21 01:08:18

Pre-Run: 164,304,592,896 bytes free
Post-Run: 164,199,272,448 bytes free

196 --- E O F --- 2008-06-19 00:04:10

Looks like it's still there

should i run the same thing in safe mode from the start again??

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, June 21, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, June 20, 2008 23:35:22
Records in database: 879831
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 116215
Threat name: 10
Infected objects: 77
Suspicious objects: 14
Duration of the scan: 02:08:33


File name / Threat name / Threats count
C:\WINDOWS\system32\ervoodfo.dll/C:\WINDOWS\system32\ervoodfo.dll Infected: Trojan.Win32.Monder.c 18
C:\WINDOWS\system32\cltdokkc.dll/C:\WINDOWS\system32\cltdokkc.dll Infected: Trojan.Win32.Monder.b 18
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive2.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive3.pst Infected: Trojan-Spy.HTML.Paylap.o 1
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive3.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive3.pst Infected: Email-Worm.Win32.Mydoom.a 14
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\archive3.pst Infected: Email-Worm.Win32.NetSky.c 2
C:\Documents and Settings\Nofearr\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Nofearr\My Documents\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\WINDOWS\system32\bajqvskb.dll.vzr Infected: not-a-virus:AdWare.Win32.Virtumonde.yzi 1
C:\WINDOWS\system32\cltdokkc.dll Infected: Trojan.Win32.Monder.b 1
C:\WINDOWS\system32\ervoodfo.dll Infected: Trojan.Win32.Monder.c 1
C:\WINDOWS\system32\trjxukrp.dll.vzr Infected: not-a-virus:AdWare.Win32.Virtumonde.yzn 1
C:\WINDOWS\system32\ucbyptcr.dll Infected: Trojan.Win32.Monder.b 1
I:\Backup\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
I:\Backup\Outlook\archive2.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 4
I:\Backup\Outlook\archive2.pst Infected: Trojan-Downloader.Win32.Tiny.dx 1
I:\Backup\Outlook\archive2.pst Infected: not-a-virus:Client-SMTP.Win32.JMail.45 1
I:\Backup\Outlook\archive3.pst Infected: Trojan-Spy.HTML.Paylap.o 1
I:\Backup\Outlook\archive3.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
I:\Backup\Outlook\archive3.pst Infected: Email-Worm.Win32.Mydoom.a 14
I:\Backup\Outlook\archive3.pst Infected: Email-Worm.Win32.NetSky.c 2
I:\Backup\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
I:\Backup\My Documents\Outlook\archive.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1

The selected area was scanned.

anyone have any suggestions? these trojans wont die

I suggest you learn some patience

We are all volunteers here with real lifes, we aren't waiting 24/7 for users to post their logs



1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\ervoodfo.dll
C:\WINDOWS\system32\cltdokkc.dll
C:\WINDOWS\system32\ucbyptcr.dll
C:\WINDOWS\system32\bajqvskb.dll.vzr
C:\WINDOWS\system32\trjxukrp.dll.vzr
C:\WINDOWS\system32\muzika.xm

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



Also post a new HijackThis log

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.