[Wizard]

Lets see if this program will flag those same files for us?


Download and Save Blacklight to your desktop (choose "I ACCEPT" then click "DOWNLOAD" on the website).

Double-click blbeta.exe then accept the agreement, click > "Scan" then > "Next".

You'll see a list of all items found. There will also be a log on your desktop with the name "fsbl.xxxxxxxxxxxxxx.log" (the xxxxxxxxxxxxxx stand for numbers).

Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

[Advertisements]

11/26/06 22:19:01 [Info]: BlackLight Engine 1.0.47 initialized
11/26/06 22:19:01 [Info]: OS: 5.1 build 2600 (Service Pack 2)
11/26/06 22:19:02 [Note]: 7019 4
11/26/06 22:19:02 [Note]: 7005 0
11/26/06 22:19:07 [Note]: 7006 0
11/26/06 22:19:07 [Note]: 7011 132
11/26/06 22:19:07 [Note]: 7026 0
11/26/06 22:19:08 [Note]: 7026 0
11/26/06 22:19:08 [Note]: 7024 3
11/26/06 22:19:08 [Info]: Hidden process: C:\windows\system32\mujdxzspt.exe
11/26/06 22:19:08 [Note]: FSRAW library version 1.7.1020
11/26/06 22:19:24 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~1.EXE
11/26/06 22:19:26 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~1.DAT
11/26/06 22:19:27 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~2.DAT
11/26/06 22:19:29 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~3.DAT
11/26/06 22:19:40 [Info]: Hidden file: c:\WINDOWS\Prefetch\MUJDXZ~1.PF
11/26/06 22:20:43 [Info]: Hidden file: c:\!KillBox\MUJDXZ~1.EXE
11/26/06 22:20:44 [Info]: Hidden file: c:\!KillBox\MUJDXZ~2.EXE
11/26/06 22:30:08 [Note]: 7007 0


this help any mate?

Thanks Danny

[DannyB100uk]

11/26/06 22:19:01 [Info]: BlackLight Engine 1.0.47 initialized
11/26/06 22:19:01 [Info]: OS: 5.1 build 2600 (Service Pack 2)
11/26/06 22:19:02 [Note]: 7019 4
11/26/06 22:19:02 [Note]: 7005 0
11/26/06 22:19:07 [Note]: 7006 0
11/26/06 22:19:07 [Note]: 7011 132
11/26/06 22:19:07 [Note]: 7026 0
11/26/06 22:19:08 [Note]: 7026 0
11/26/06 22:19:08 [Note]: 7024 3
11/26/06 22:19:08 [Info]: Hidden process: C:\windows\system32\mujdxzspt.exe
11/26/06 22:19:08 [Note]: FSRAW library version 1.7.1020
11/26/06 22:19:24 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~1.EXE
11/26/06 22:19:26 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~1.DAT
11/26/06 22:19:27 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~2.DAT
11/26/06 22:19:29 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MUJDXZ~3.DAT
11/26/06 22:19:40 [Info]: Hidden file: c:\WINDOWS\Prefetch\MUJDXZ~1.PF
11/26/06 22:20:43 [Info]: Hidden file: c:\!KillBox\MUJDXZ~1.EXE
11/26/06 22:20:44 [Info]: Hidden file: c:\!KillBox\MUJDXZ~2.EXE
11/26/06 22:30:08 [Note]: 7007 0


this help any mate?

Thanks Danny

[Wizard]

Thatll do the trick I believe.

Run Blacklight again and have blacklight rename everything it finds.


Now you must restart the machine first and then Download Brute Force Uninstaller.
Unzip it to it’s own folder (c:\BFU)

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download EGDACCESS Remover. Save it in the folder you made earlier (c:\BFU)

Start the Brute Force Uninstaller by doubleclicking BFU.exe

In the scriptline to execute copy and paste c:\bfu\EGDACCESS.bfu
Press execute and let it do it’s job.

Wait for the complete script execution box to popup and press OK.
Press exit to terminate the BFU program.


Restart Normal and run GMER once more.

Save the new log and post that along with a fresh HijackThis log,please.

[DannyB100uk]

Logfile of HijackThis v1.99.1
Scan saved at 00:17:48, on 27/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\LMIB3.tmp\rescue.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\becca\Desktop\tools\virus.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll (file missing)
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll (file missing)
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [mujdxzspt] c:\windows\system32\mujdxzspt.exe mujdxzspt
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [LogMeInRescue_3197083591] "C:\WINDOWS\LMIB3.tmp\rescue.exe" reboot
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay11...es/MsnPUpld.cab
O16 - DPF: {826287F8-454E-11D9-ADFE-00062919A34C} (ActiveXUploadFotoCom.UserCtrlFotoCom) - http://express.foto....loadFotoCom.CAB
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-sec.../ols3/fscax.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

AND GMER SCAN

GMER 1.0.12.11889 - http://www.gmer.net
Rootkit scan 2006-11-27 00:35:56
Windows 5.1.2600 Service Pack 2


---- User code sections - GMER 1.0.12 ----

.text C:\WINDOWS\Explorer.EXE[1348] WS2_32.dll!connect 71AB406A 5 Bytes JMP 015E3E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll
.text C:\Program Files\McAfee.com\VSO\mcvsshld.exe[1624] WS2_32.dll!connect 71AB406A 5 Bytes JMP 013D3E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll
.text C:\Program Files\McAfee.com\VSO\oasclnt.exe[1632] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00F53E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll
.text C:\PROGRA~1\mcafee.com\agent\mcagent.exe[1660] WS2_32.dll!connect 71AB406A 5 Bytes JMP 01423E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[1724] WS2_32.dll!connect 71AB406A 5 Bytes JMP 01B03E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll
.text ...
.text C:\Documents and Settings\becca\Desktop\tools\gmer\gmer.exe[3024] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00F13E00 c:\progra~1\mcafee.com\vso\McVSSkt.dll

---- EOF - GMER 1.0.12 ----


This Ok?
Thanks Mate

[Wizard]

If any of the renamed files still exist you should be able to find them fairly easy and delete them.

C:\WINDOWS\system32\mujdxzspt.exe
C:\WINDOWS\system32\mujdxzspt.dat
C:\WINDOWS\system32\mujdxzspt_nav.dat
C:\WINDOWS\system32\mujdxzspt_navps.dat
C:\WINDOWS\Prefetch\MUJDXZSPT.EXE-05EF6EA8.pf

mujdxzspt<-- that will stay the same,the extensions may be whats renamed.

May look like this now--> C:\WINDOWS\system32\mujdxzspt.0xe

Hopefully the bfu fix got everything cleared out.

Have the popups ceased or are they still appearing?


Open HijackThis-> Click "Do a System Scan Only" and put a check by these but DO NOT hit the Fix Checked button yet

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [mujdxzspt] c:\windows\system32\mujdxzspt.exe mujdxzspt

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button


Scan fresh with ComboFix and post that log.

After posting that log,Please run the Bit Defender Online Scan
http://www.bitdefend...m/scan8/ie.html

You must use Internet Explorer for this scanner.

Install the ActiveX and Click on "Click here to Scan"

Allow it to update and Scan the Machine.

It should disinfect or delete whatever it finds that is infected.

Save the report in generates in a text format please and post it back here

[DannyB100uk]

IT worked to begin with but my internet is now limited or no connectivity any idea's how this happened? or is it something else?

[DannyB100uk]

any ideas?