Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

nnnolkh.dll [RESOLVED]

Started by Viper Jr. , Mar 13 2008 04:41 PM

This topic is locked

#1
Viper Jr.

Posted 13 March 2008 - 04:41 PM

Member

Member
33 posts

Hello.
I need som help. I recently bought a new computer and it's been running fine without any trojans, viruses and so on. I use NOD32, Ad-aware 2007 and CCleaner to keep away unwanted things. However, I recently discovered a infected file (NOD32 found it), but NOD32, ad-aware, DrDelete can NOT delete or move it. I also tried to delete it manuall in safe mode, it did not work. So, I´m posting my HijackThis log here and I´ll hope to get som help. The file that is unremovable is called "nnnolkh.dll" and is located in C:/WINDOWS/system32/nnnolkh.dll.
I´m using Windows XP Pro SP2 and surfing the internet with Opera (if that's important to know).
I´m thinking that nnnolkh.dll can not be removed since some process is keeping it busy and I quess hijackthis found the process. But I have no idea which it is.

Also, I´m new to the forum, so please be forgiving if I posted the post in the wrong room or something like that.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:44 PM, on 13-Mar-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\NOD32\egui.exe
C:\PROGRA~1\A4TECH~1\Amoumain.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\NOD32\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\JijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\NOD32\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH~1\Amoumain.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [9c2faa4e] rundll32.exe "C:\WINDOWS\system32\ybtencuy.dll",b
O4 - HKLM\..\Run: [BM9f1c99d2] Rundll32.exe "C:\WINDOWS\system32\tpbeckbp.dll",s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\NOD32\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\NOD32\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Edited by Viper Jr., 13 March 2008 - 04:48 PM.

#2
kahdah

Posted 13 March 2008 - 05:46 PM

GeekU Teacher

Retired Staff
15,822 posts

ello Viper Jr.

Welcome to G2Go.

=====================
Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

#3
Viper Jr.

Posted 14 March 2008 - 12:28 AM

Member

Topic Starter
Member
33 posts

Quick reply! ^^

Ok, first the ComoFix log:

ComboFix 08-03-13.4 - Viper Jr 2008-03-14 7:20:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1566 [GMT 1:00]
Running from: C:\Documents and Settings\Viper Jr\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\ijjlm.ini
C:\WINDOWS\system32\ijjlm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\tpbeckbp.dll
C:\WINDOWS\system32\ukiwkbaw.dll
C:\WINDOWS\system32\ybtencuy.dll
C:\WINDOWS\system32\yucnetby.ini

.
((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
.

2008-03-13 23:24 . 2008-03-13 23:40 <DIR> d-------- C:\Program Files\JijackThis
2008-03-13 15:50 . 2008-03-13 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CCP
2008-03-11 19:26 . 2008-03-11 19:55 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Command & Conquer 3 Tiberium Wars
2008-03-11 13:27 . 2008-03-11 13:27 754 --a------ C:\WINDOWS\WORDPAD.INI
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-03-11 13:00 . 2008-03-11 13:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-03-11 12:59 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll
2008-03-11 12:59 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-11 12:59 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-11 12:09 . 2008-03-11 12:09 <DIR> d-------- C:\Program Files\HP
2008-03-11 12:06 . 2008-03-11 13:02 140,956 --a------ C:\WINDOWS\hpoins14.dat
2008-03-11 12:06 . 2007-09-20 16:56 2,000 --------- C:\WINDOWS\hpomdl14.dat
2008-03-11 08:21 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-03-09 17:40 . 2008-03-09 17:40 34,816 --a------ C:\WINDOWS\system32\nnnolkh.dll
2008-03-09 13:41 . 2008-03-09 16:52 <DIR> d-------- C:\Program Files\CCCP
2008-02-27 11:47 . 2008-02-27 11:48 <DIR> d-------- C:\Program Files\MSN Messenger
2008-02-26 17:48 . 2008-02-26 17:48 <DIR> d-------- C:\Program Files\Hamachi
2008-02-26 17:48 . 2008-03-12 22:13 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Hamachi
2008-02-26 17:48 . 2008-02-26 17:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-26 17:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-26 17:07 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-26 10:07 . 2008-02-26 10:07 <DIR> d-------- C:\Program Files\EMS TrioLinker Plus II
2008-02-26 10:07 . 2008-02-26 10:07 3,239,936 --a------ C:\WINDOWS\system32\EMSTrioCP.dll
2008-02-26 10:07 . 2008-02-26 10:07 225,354 --a------ C:\WINDOWS\system32\EMSTrioFF.DLL
2008-02-26 10:07 . 2008-02-26 10:07 9,744 --a------ C:\WINDOWS\system32\drivers\TLKerII.SYS
2008-02-26 10:07 . 2008-02-26 10:07 3,536 --a------ C:\WINDOWS\system32\drivers\FltrKbd.SYS
2008-02-25 17:33 . 2008-02-25 17:33 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Leadertech
2008-02-25 12:53 . 2008-02-25 12:53 0 --a------ C:\WINDOWS\PowerReg.dat
2008-02-25 12:15 . 2008-02-25 12:15 <DIR> dr-h----- C:\Documents and Settings\Viper Jr\Application Data\SecuROM
2008-02-25 11:38 . 2004-08-18 04:14 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-02-24 01:09 . 2008-02-24 01:09 <DIR> d-------- C:\Program Files\directx
2008-02-23 20:53 . 2008-02-23 20:53 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\InstallShield
2008-02-23 18:00 . 2008-02-23 18:06 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\BPFTP
2008-02-23 16:47 . 2008-02-23 16:47 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\FlashFXP
2008-02-23 16:46 . 2008-02-23 16:47 <DIR> d-------- C:\Program Files\FlashFXP
2008-02-22 19:10 . 2008-02-22 19:10 <DIR> d-------- C:\Program Files\uTorrent
2008-02-22 19:10 . 2008-03-12 17:00 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\uTorrent
2008-02-22 18:07 . 2008-02-22 18:13 <DIR> d-------- C:\Program Files\Media Player Classic
2008-02-22 18:07 . 2008-02-22 18:07 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Media Player Classic
2008-02-22 15:30 . 2008-03-09 13:33 8 --a------ C:\WINDOWS\system32\nvModes.dat
2008-02-22 15:28 . 2008-02-22 15:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-22 07:21 . 2008-02-22 07:23 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\My Battle for Middle-earth™ II Files
2008-02-21 22:00 . 2008-02-23 21:35 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Petroglyph
2008-02-21 21:42 . 2008-02-25 12:15 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-21 18:39 . 2008-02-21 18:39 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\.BitTornado
2008-02-21 18:16 . 2008-02-21 18:37 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-21 18:14 . 2008-02-21 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-02-21 18:14 . 2008-03-11 08:33 19 --a------ C:\WINDOWS\popcinfo.dat
2008-02-21 16:54 . 2008-02-21 16:54 661 --a------ C:\WINDOWS\eReg.dat
2008-02-20 18:31 . 2008-02-20 18:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-20 18:31 . 2008-02-20 18:32 <DIR> d-------- C:\Program Files\Ad-Aware
2008-02-20 18:31 . 2008-02-20 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-20 14:46 . 2008-02-20 14:46 <DIR> d-------- C:\Program Files\Winamp
2008-02-20 14:46 . 2008-02-20 14:48 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Winamp
2008-02-20 14:40 . 2008-02-20 14:43 <DIR> d-------- C:\Program Files\A4Tech Mouse
2008-02-20 14:40 . 2004-08-25 17:52 409,600 --a------ C:\WINDOWS\system32\Amoucplx.dll
2008-02-20 14:40 . 2004-08-25 17:46 389,120 --a------ C:\WINDOWS\system32\Amsample.dll
2008-02-20 14:40 . 2004-08-25 17:32 102,400 --a------ C:\WINDOWS\system32\Amuninst.exe
2008-02-20 14:40 . 2004-08-25 17:29 86,016 --a------ C:\WINDOWS\system32\Amoures.dll
2008-02-20 14:40 . 2004-08-25 17:29 36,864 --a------ C:\WINDOWS\system32\Amhooker.dll
2008-02-20 14:40 . 2004-08-25 17:09 20,096 --a------ C:\WINDOWS\system32\drivers\Amserprt.sys
2008-02-20 14:40 . 2004-08-25 17:09 10,240 --a------ C:\WINDOWS\system32\drivers\Amusbprt.sys
2008-02-20 14:40 . 2004-08-25 17:09 9,984 --a------ C:\WINDOWS\system32\drivers\Amps2prt.sys
2008-02-20 14:40 . 2004-08-25 17:09 7,424 --a------ C:\WINDOWS\system32\drivers\Arfumftr.sys
2008-02-20 14:40 . 2004-08-25 17:09 5,120 --a------ C:\WINDOWS\system32\drivers\Amfilter.sys
2008-02-20 09:00 . 2008-02-21 12:10 <DIR> d-------- C:\Documents and Settings\Viper Jr\Contacts
2008-02-20 08:46 . 2008-02-20 08:46 <DIR> d-------- C:\Program Files\CCleaner
2008-02-20 08:44 . 2008-02-20 08:44 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-20 08:43 . 2008-02-20 08:43 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\DAEMON Tools
2008-02-20 08:43 . 2008-02-20 08:43 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-20 08:41 . 2008-02-20 08:41 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-20 08:41 . 2008-02-20 08:41 <DIR> d-------- C:\Program Files\CloneCD
2008-02-20 08:41 . 2008-02-20 08:47 24 ---hs---- C:\WINDOWS\S16DEF127.tmp
2008-02-20 08:38 . 2008-02-20 08:38 <DIR> d-------- C:\Program Files\Opera
2008-02-20 08:10 . 2008-02-20 13:33 <DIR> d-------- C:\Program Files\ESET
2008-02-20 08:10 . 2008-02-20 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-02-19 23:01 . 2004-08-03 23:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-19 23:01 . 2001-08-17 14:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-19 23:00 . 2004-08-04 00:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-02-19 23:00 . 2004-08-04 00:56 74,240 --a--c--- C:\WINDOWS\system32\dllcache\usbui.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-09 16:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-21 17:39 --------- d-----w C:\Documents and Settings\Viper Jr\Application Data\.BitTornado
2008-02-21 15:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-19 21:36 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-19 21:36 --------- d-----w C:\Program Files\Realtek
2008-02-19 21:35 --------- d-----w C:\Program Files\Intel
2008-02-19 21:30 --------- d-----w C:\Program Files\Nvidia
2008-02-19 21:19 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-19 21:15 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F501C2AB-834A-4B9D-A86B-A1EADA760B00}]
2008-03-09 17:40 34816 --a------ C:\WINDOWS\system32\nnnolkh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 08:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"egui"="C:\Program Files\ESET\NOD32\egui.exe" [2007-12-21 08:21 1443072]
"WheelMouse"="C:\PROGRA~1\A4TECH~1\Amoumain.exe" [2004-08-25 17:31 147456]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]

C:\Documents and Settings\Viper Jr\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2008-02-25 12:54:00 225280]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F501C2AB-834A-4B9D-A86B-A1EADA760B00}"= C:\WINDOWS\system32\nnnolkh.dll [2008-03-09 17:40 34816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnolkh]
nnnolkh.dll 2008-03-09 17:40 34816 C:\WINDOWS\system32\nnnolkh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\Entertainment\\Spel\\Rise of Legends\\legends.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Entertainment\\Spel\\EVE-Online\\bin\\ExeFile.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Entertainment\\Spel\\DarkPlanet\\Dark.exe"=
"D:\\Entertainment\\Spel\\The Lord of The Ring-Battle for Middle-earth II\\game.dat"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"D:\\Entertainment\\Spel\\Empire at War\\Forces of Corruption\\swfoc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2main.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2main_amdxp.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwupdate.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2server.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13176:TCP"= 13176:TCP:BitComet 13176 TCP
"13176:UDP"= 13176:UDP:BitComet 13176 UDP

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
S3 Arfumftr;A4Tech USB RF-Mouse filter driver;C:\WINDOWS\system32\DRIVERS\Arfumftr.sys [2004-08-25 17:09]
S3 TrioLinkerII;TrioLinkerII;C:\WINDOWS\system32\Drivers\TLKerII.sys [2008-02-26 10:07]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 07:24:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\nnnolkh.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\NOD32\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-03-14 7:25:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-14 06:25:40

And now the HihackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:28:34 AM, on 14-Mar-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\NOD32\egui.exe
C:\PROGRA~1\A4TECH~1\Amoumain.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\NOD32\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\JijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: (no name) - {F501C2AB-834A-4B9D-A86B-A1EADA760B00} - C:\WINDOWS\system32\nnnolkh.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\NOD32\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH~1\Amoumain.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: nnnolkh - C:\WINDOWS\SYSTEM32\nnnolkh.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\NOD32\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\NOD32\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3424 bytes

#4
kahdah

Posted 14 March 2008 - 10:22 AM

GeekU Teacher

Retired Staff
15,822 posts

1. Please open Notepad

Click Start , then Run
type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\nnnolkh.dll
C:\Documents and Settings\Viper Jr\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F501C2AB-834A-4B9D-A86B-A1EADA760B00}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F501C2AB-834A-4B9D-A86B-A1EADA760B00}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnolkh]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

#5
Viper Jr.

Posted 16 March 2008 - 01:18 PM

Member

Topic Starter
Member
33 posts

Sorry for the late reply, I was away during the weekend.

Here is the CombatFix log that I got after draging the CFScript.txt into the CombatFix icon. I don't know if it makes any diffrence, but when CombatFix was running, NOD32 detected the file (nnnolkh.dll) several times. And I can't find the file in system32 now. ^^

By the way, when everthing is finnished, can I delete the Combatfix-files that are located in C:/ ?

ComboFix 08-03-13.4 - Viper Jr 2008-03-16 20:13:16.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1650 [GMT 1:00]
Running from: C:\Documents and Settings\Viper Jr\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Viper Jr\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Viper Jr\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
C:\WINDOWS\system32\nnnolkh.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Viper Jr\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
C:\WINDOWS\system32\nnnolkh.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 )))))))))))))))))))))))))))))))
.

2008-03-13 23:24 . 2008-03-14 07:28 <DIR> d-------- C:\Program Files\JijackThis
2008-03-13 15:50 . 2008-03-13 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CCP
2008-03-11 19:26 . 2008-03-11 19:55 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Command & Conquer 3 Tiberium Wars
2008-03-11 13:27 . 2008-03-11 13:27 754 --a------ C:\WINDOWS\WORDPAD.INI
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Common Files\HP
2008-03-11 13:01 . 2008-03-11 13:01 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-03-11 13:00 . 2008-03-11 13:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-03-11 12:59 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll
2008-03-11 12:59 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-11 12:59 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-11 12:09 . 2008-03-11 12:09 <DIR> d-------- C:\Program Files\HP
2008-03-11 12:06 . 2008-03-11 13:02 140,956 --a------ C:\WINDOWS\hpoins14.dat
2008-03-11 12:06 . 2007-09-20 16:56 2,000 --------- C:\WINDOWS\hpomdl14.dat
2008-03-11 08:21 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-03-09 13:41 . 2008-03-09 16:52 <DIR> d-------- C:\Program Files\CCCP
2008-02-27 11:47 . 2008-02-27 11:48 <DIR> d-------- C:\Program Files\MSN Messenger
2008-02-26 17:48 . 2008-02-26 17:48 <DIR> d-------- C:\Program Files\Hamachi
2008-02-26 17:48 . 2008-03-12 22:13 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Hamachi
2008-02-26 17:48 . 2008-02-26 17:48 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2008-02-26 17:07 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-26 17:07 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-26 10:07 . 2008-02-26 10:07 <DIR> d-------- C:\Program Files\EMS TrioLinker Plus II
2008-02-26 10:07 . 2008-02-26 10:07 3,239,936 --a------ C:\WINDOWS\system32\EMSTrioCP.dll
2008-02-26 10:07 . 2008-02-26 10:07 225,354 --a------ C:\WINDOWS\system32\EMSTrioFF.DLL
2008-02-26 10:07 . 2008-02-26 10:07 9,744 --a------ C:\WINDOWS\system32\drivers\TLKerII.SYS
2008-02-26 10:07 . 2008-02-26 10:07 3,536 --a------ C:\WINDOWS\system32\drivers\FltrKbd.SYS
2008-02-25 17:33 . 2008-02-25 17:33 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Leadertech
2008-02-25 12:53 . 2008-02-25 12:53 0 --a------ C:\WINDOWS\PowerReg.dat
2008-02-25 12:15 . 2008-02-25 12:15 <DIR> dr-h----- C:\Documents and Settings\Viper Jr\Application Data\SecuROM
2008-02-25 11:38 . 2004-08-18 04:14 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
2008-02-24 01:09 . 2008-02-24 01:09 <DIR> d-------- C:\Program Files\directx
2008-02-23 20:53 . 2008-02-23 20:53 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\InstallShield
2008-02-23 18:00 . 2008-02-23 18:06 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\BPFTP
2008-02-23 16:47 . 2008-02-23 16:47 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\FlashFXP
2008-02-23 16:46 . 2008-02-23 16:47 <DIR> d-------- C:\Program Files\FlashFXP
2008-02-22 19:10 . 2008-02-22 19:10 <DIR> d-------- C:\Program Files\uTorrent
2008-02-22 19:10 . 2008-03-12 17:00 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\uTorrent
2008-02-22 18:07 . 2008-02-22 18:13 <DIR> d-------- C:\Program Files\Media Player Classic
2008-02-22 18:07 . 2008-02-22 18:07 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Media Player Classic
2008-02-22 15:30 . 2008-03-09 13:33 8 --a------ C:\WINDOWS\system32\nvModes.dat
2008-02-22 15:28 . 2008-02-22 15:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-02-22 07:21 . 2008-02-22 07:23 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\My Battle for Middle-earth™ II Files
2008-02-21 22:00 . 2008-02-23 21:35 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Petroglyph
2008-02-21 21:42 . 2008-02-25 12:15 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-21 18:39 . 2008-02-21 18:39 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\.BitTornado
2008-02-21 18:16 . 2008-02-21 18:37 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-21 18:14 . 2008-02-21 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-02-21 18:14 . 2008-03-11 08:33 19 --a------ C:\WINDOWS\popcinfo.dat
2008-02-21 16:54 . 2008-02-21 16:54 661 --a------ C:\WINDOWS\eReg.dat
2008-02-20 18:31 . 2008-02-20 18:31 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-20 18:31 . 2008-02-20 18:32 <DIR> d-------- C:\Program Files\Ad-Aware
2008-02-20 18:31 . 2008-02-20 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-20 14:46 . 2008-02-20 14:46 <DIR> d-------- C:\Program Files\Winamp
2008-02-20 14:46 . 2008-02-20 14:48 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\Winamp
2008-02-20 14:40 . 2008-02-20 14:43 <DIR> d-------- C:\Program Files\A4Tech Mouse
2008-02-20 14:40 . 2004-08-25 17:52 409,600 --a------ C:\WINDOWS\system32\Amoucplx.dll
2008-02-20 14:40 . 2004-08-25 17:46 389,120 --a------ C:\WINDOWS\system32\Amsample.dll
2008-02-20 14:40 . 2004-08-25 17:32 102,400 --a------ C:\WINDOWS\system32\Amuninst.exe
2008-02-20 14:40 . 2004-08-25 17:29 86,016 --a------ C:\WINDOWS\system32\Amoures.dll
2008-02-20 14:40 . 2004-08-25 17:29 36,864 --a------ C:\WINDOWS\system32\Amhooker.dll
2008-02-20 14:40 . 2004-08-25 17:09 20,096 --a------ C:\WINDOWS\system32\drivers\Amserprt.sys
2008-02-20 14:40 . 2004-08-25 17:09 10,240 --a------ C:\WINDOWS\system32\drivers\Amusbprt.sys
2008-02-20 14:40 . 2004-08-25 17:09 9,984 --a------ C:\WINDOWS\system32\drivers\Amps2prt.sys
2008-02-20 14:40 . 2004-08-25 17:09 7,424 --a------ C:\WINDOWS\system32\drivers\Arfumftr.sys
2008-02-20 14:40 . 2004-08-25 17:09 5,120 --a------ C:\WINDOWS\system32\drivers\Amfilter.sys
2008-02-20 09:00 . 2008-02-21 12:10 <DIR> d-------- C:\Documents and Settings\Viper Jr\Contacts
2008-02-20 08:46 . 2008-02-20 08:46 <DIR> d-------- C:\Program Files\CCleaner
2008-02-20 08:44 . 2008-02-20 08:44 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-20 08:43 . 2008-02-20 08:43 <DIR> d-------- C:\Documents and Settings\Viper Jr\Application Data\DAEMON Tools
2008-02-20 08:43 . 2008-02-20 08:43 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-20 08:41 . 2008-02-20 08:41 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-20 08:41 . 2008-02-20 08:41 <DIR> d-------- C:\Program Files\CloneCD
2008-02-20 08:41 . 2008-02-20 08:47 24 ---hs---- C:\WINDOWS\S16DEF127.tmp
2008-02-20 08:38 . 2008-02-20 08:38 <DIR> d-------- C:\Program Files\Opera
2008-02-20 08:10 . 2008-02-20 13:33 <DIR> d-------- C:\Program Files\ESET
2008-02-20 08:10 . 2008-02-20 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-02-19 23:01 . 2004-08-03 23:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-19 23:01 . 2001-08-17 14:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-19 23:00 . 2004-08-04 00:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-02-19 23:00 . 2004-08-04 00:56 74,240 --a--c--- C:\WINDOWS\system32\dllcache\usbui.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-09 16:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-21 17:39 --------- d-----w C:\Documents and Settings\Viper Jr\Application Data\.BitTornado
2008-02-21 15:43 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-19 21:36 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-19 21:36 --------- d-----w C:\Program Files\Realtek
2008-02-19 21:35 --------- d-----w C:\Program Files\Intel
2008-02-19 21:30 --------- d-----w C:\Program Files\Nvidia
2008-02-19 21:19 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-19 21:15 --------- d-----w C:\Program Files\Windows Media Connect 2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 08:28 16126464 C:\WINDOWS\RTHDCPL.exe]
"egui"="C:\Program Files\ESET\NOD32\egui.exe" [2007-12-21 08:21 1443072]
"WheelMouse"="C:\PROGRA~1\A4TECH~1\Amoumain.exe" [2004-08-25 17:31 147456]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\Entertainment\\Spel\\Rise of Legends\\legends.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"D:\\Entertainment\\Spel\\EVE-Online\\bin\\ExeFile.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Entertainment\\Spel\\DarkPlanet\\Dark.exe"=
"D:\\Entertainment\\Spel\\The Lord of The Ring-Battle for Middle-earth II\\game.dat"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"D:\\Entertainment\\Spel\\Empire at War\\Forces of Corruption\\swfoc.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2main.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2main_amdxp.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwupdate.exe"=
"D:\\Entertainment\\Spel\\NeverWinter Nights 2\\nwn2server.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13176:TCP"= 13176:TCP:BitComet 13176 TCP
"13176:UDP"= 13176:UDP:BitComet 13176 UDP

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
S3 Arfumftr;A4Tech USB RF-Mouse filter driver;C:\WINDOWS\system32\DRIVERS\Arfumftr.sys [2004-08-25 17:09]
S3 TrioLinkerII;TrioLinkerII;C:\WINDOWS\system32\Drivers\TLKerII.sys [2008-02-26 10:07]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 20:15:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\NOD32\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2008-03-16 20:16:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-16 19:16:26
ComboFix2.txt 2008-03-14 06:25:47

And the new HighjackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:00 PM, on 16-Mar-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\NOD32\egui.exe
C:\PROGRA~1\A4TECH~1\Amoumain.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\NOD32\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\JijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\NOD32\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH~1\Amoumain.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Ad-Aware\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\NOD32\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\NOD32\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3287 bytes

Edited by Viper Jr., 16 March 2008 - 01:21 PM.

#6
kahdah

Posted 16 March 2008 - 01:20 PM

GeekU Teacher

Retired Staff
15,822 posts

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

#7
Viper Jr.

Posted 16 March 2008 - 01:44 PM

Member

Topic Starter
Member
33 posts

I edited the last reply, but you had already answered so I´m asking again. ^^

Can I delete all the ComboFix-files that are located direkt under C: when this completed?

The log from mbam:

Malwarebytes' Anti-Malware 1.08
Database version: 497

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 92247
Time elapsed: 15 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#8
kahdah

Posted 16 March 2008 - 02:03 PM

GeekU Teacher

Retired Staff
15,822 posts

Yes but before we will finish we will uninstall combofix and delete the leftovers.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
================================================================
Please do an online scan with Kaspersky WebScanner
(This scanner is for use with internet explorer only)
Click on "Accept"

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

#9
Viper Jr.

Posted 17 March 2008 - 06:15 AM

Member

Topic Starter
Member
33 posts

A whole lot of scanning done by Kaspersky. Here's the log!

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, March 17, 2008 1:15:52 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 17/03/2008
Kaspersky Anti-Virus database records: 635350
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
F:\

Scan Statistics:
Total number of scanned objects: 66804
Number of viruses found: 3
Number of infected objects: 20
Number of suspicious objects: 0
Duration of the scan process: 01:28:05

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Charon\CACHE.NDB Object is locked skipped
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\virlog.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Logs\warnlog.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Viper Jr\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Viper Jr\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Viper Jr\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Viper Jr\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\tpbeckbp.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ukiwkbaw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ybtencuy.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-14_ 72433.90.zip/mljji.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-14_ 72433.90.zip ZIP: infected - 1 skipped
C:\QooBox\Quarantine\catchme2008-03-16_201552.64.zip/nnnolkh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\QooBox\Quarantine\catchme2008-03-16_201552.64.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP13\A0000201.exe/stream/data0050 Infected: not-a-virus:AdWare.Win32.Shopper.r skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP13\A0000201.exe/stream Infected: not-a-virus:AdWare.Win32.Shopper.r skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP13\A0000201.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP25\A0005136.exe/Stream/data0005 Infected: not-a-virus:Server-FTP.Win32.BulletProof.231 skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP25\A0005136.exe/Stream Infected: not-a-virus:Server-FTP.Win32.BulletProof.231 skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP25\A0005136.exe Inno: infected - 2 skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP40\A0008366.exe Infected: not-a-virus:Server-FTP.Win32.BulletProof.231 skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP54\A0014553.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP54\A0014554.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP54\A0014555.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP55\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\S16DEF127.tmp Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP49\A0008905.exe/data.rar/is151574.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
D:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP49\A0008905.exe/data.rar Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
D:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP49\A0008905.exe RarSFX: infected - 2 skipped
D:\System Volume Information\_restore{D4C4CA5F-D777-4737-9985-D06B82207499}\RP55\change.log Object is locked skipped

Scan process completed.

#10
kahdah

Posted 17 March 2008 - 05:17 PM

GeekU Teacher

Retired Staff
15,822 posts

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK

Doing this unistalls Combofix and does the following:

Deletes ComboFix and its associated files and folders.
Deletes VundoFix backups, if present
Deletes the C:\Deckard folder, if present
Deletes the C:_OtMoveIt folder, if present
Resets the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Clean System Restore points.

Also delete\uninstall anything that we used that is left over.
===========================================
After that Your log is clean.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein ->Here

#11
Viper Jr.

Posted 18 March 2008 - 12:44 AM

Member

Topic Starter
Member
33 posts

Thanks a lot! You really helped me out here, the computer is running as normal again.

I´m just a little curious. The kasperky said that there was 20 infections and 3 viruses? Are they gone? ^^

#12
kahdah

Posted 18 March 2008 - 03:26 AM

GeekU Teacher

Retired Staff
15,822 posts

Yes they were in Combofix's quarantine folder which e removed and also in the system restore points which we also removed when you uninstalled Combofix.

You are welcome

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If your the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

#13
kahdah

Posted 18 March 2008 - 03:26 AM

GeekU Teacher

Retired Staff
15,822 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.