[Rorschach112]

Ok time for the big guns

CLICK THIS TO LINK TO BE SURE YOU CAN VIEW HIDDEN FILES

Please go here:
The Spy Killer Forum

• Click on "New Topic"
• Put your name, e-mail address, and this as the title: "C:\ProgramData\rsnozato\vwvefena.exe"
• Put a link to this topic in the description box.
• Then next to the file box, at the bottom, click the browse button, then navigate to this file:
  
  
  
  • C:\ProgramData\rsnozato\vwvefena.exe
  
  
• Click Open.
• Click Post.

Thank you!



Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[Advertisements]

Hi there,

I made my files and folders viewable and then i went to make the post on the other forum but was unable to find the file you wanted me to attach...

I found the folder called "ProgramData" but the subfolder nor file was there

what should I do?

[ryan38]

Hi there,

I made my files and folders viewable and then i went to make the post on the other forum but was unable to find the file you wanted me to attach...

I found the folder called "ProgramData" but the subfolder nor file was there

what should I do?

[Rorschach112]

Just go on and run ComboFix there

[ryan38]

Hi im going to attach the log.txt for the combofix

wasn't sure what i was supposed to do in highjack this? System scan only?? and then analize it? or could you clarify it for me?

Thanks

Attached Files

•  ComboFix.txt   14.4KB   109 downloads

[Rorschach112]

Hello

No need to attach the logs

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

Folder::
C:\ProgramData\rsnozato
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"HjfnwIoLfU"=-

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



Then reboot and post a new HijackThis log like you did at the start

[ryan38]

Here are the two logs!!

here is the combofix

--------------------------------------------------

ComboFix 08-03-30.4 - Ryan 2008-04-01 17:42:24.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.365 [GMT -2.5:30]
Running from: C:\Users\Ryan\Desktop\ComboFix.exe
Command switches used :: C:\Users\Ryan\Desktop\CFScript.txt
* Created a new restore point
.
TimedOut: Windir.dat

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 20:14 --------- d-----w C:\Users\Ryan\AppData\Roaming\DNA
2008-03-30 21:23 --------- d-----w C:\Program Files\Trend Micro
2008-03-30 19:44 --------- d-----w C:\Users\Ryan\AppData\Roaming\BitTorrent
2008-03-30 19:39 --------- d-----w C:\Users\Ryan\AppData\Roaming\Grisoft
2008-03-30 19:38 --------- d-----w C:\ProgramData\Grisoft
2008-03-30 16:45 --------- d-----w C:\Users\Ryan\AppData\Roaming\STOIK
2008-03-30 16:45 --------- d-----w C:\Program Files\STOIK Imaging
2008-03-30 16:33 --------- d-----w C:\Users\Ryan\AppData\Roaming\BearShare
2008-03-29 18:48 --------- d-----w C:\Program Files\Yahoo!
2008-03-29 01:49 86,528 ----a-w C:\Windows\System32\VACFix.exe
2008-03-28 09:51 --------- d-----w C:\ProgramData\Lavasoft
2008-03-28 09:48 --------- d-----w C:\Program Files\Lavasoft
2008-03-28 09:46 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-26 11:20 82,432 ----a-w C:\Windows\System32\IEDFix.exe
2008-03-23 02:23 --------- d-----w C:\ProgramData\Yahoo!
2008-03-15 13:32 22 ----a-w C:\Users\All Users\ReturnCounter.dat
2008-03-15 13:32 22 ----a-w C:\ProgramData\ReturnCounter.dat
2008-03-15 12:34 --------- d-----w C:\Program Files\Phanku eTaxCanada 2007
2008-03-12 05:42 --------- d-----w C:\Program Files\Windows Mail
2008-03-12 05:36 --------- d-----w C:\ProgramData\Microsoft Help
2008-03-05 00:49 --------- d-----w C:\Program Files\Instant CD & DVD Burner
2008-03-02 17:39 --------- d-----w C:\Program Files\Xvid
2008-02-29 00:55 --------- d-----w C:\Users\Ryan\AppData\Roaming\Elluminate
2008-02-20 12:32 --------- d-----w C:\ProgramData\Office Genuine Advantage
2008-02-14 15:49 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-02-14 15:49 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-14 15:42 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-14 15:42 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe
2008-02-14 15:42 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-14 15:42 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-14 15:42 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-14 15:42 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-02-14 15:42 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-14 15:40 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-14 15:40 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-14 15:40 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-14 15:40 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-14 15:40 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-14 15:39 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-14 15:39 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-14 15:39 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 15:39 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-14 15:39 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-14 15:39 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-02-14 15:05 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-14 15:05 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-14 15:04 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-14 15:04 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-06 06:31 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-04 22:29 --------- d-----w C:\Program Files\Rainbow Technologies
2008-02-04 22:07 --------- d-----w C:\Program Files\ESRI
2008-02-04 22:06 --------- d-----w C:\Users\Ryan\AppData\Roaming\ESRI
2008-02-04 21:52 --------- d-----w C:\ProgramData\ESRI
2008-02-04 21:52 --------- d-----w C:\Program Files\Common Files\ESRI
2008-02-04 21:51 --------- d-----w C:\Program Files\ArcGIS
2008-02-04 21:50 --------- d-----w C:\Program Files\Leica Geosystems
2008-02-03 16:24 --------- d-----w C:\Users\Ryan\AppData\Roaming\LimeWire
2008-02-01 21:50 --------- d-----w C:\Program Files\LimeWire
2008-02-01 21:40 --------- d-----w C:\Program Files\Ares
2008-02-01 21:22 --------- d-----w C:\Program Files\BearShare Applications
2008-01-19 20:57 229,888 ----a-w C:\Windows\System32\msshsq.dll
2008-01-10 05:50 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2008-01-09 06:32 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2007-12-08 13:04 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-03-31_20.01.53.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-31 21:58:54 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-04-01 20:04:42 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-03-31 22:14:15 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2008-04-01 20:04:50 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2008-03-31 22:26:41 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2008-04-01 20:11:35 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2008-03-31 22:01:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-31 23:22:50 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-03-31 23:22:50 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-03-31 19:03:41 188,656 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-04-01 20:04:45 188,960 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 04:02 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 10:04 2159104 C:\Windows\System32\oobefldr.dll]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 10:05 125440]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-18 20:02 171448]
"BitTorrent DNA"="C:\Users\Ryan\Program Files\DNA\btdna.exe" [2008-03-28 22:08 288576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 21:35 200704]
"BurnQuick Queue"="C:\Program Files\BurnQuick\BQTray.exe" [2007-09-01 14:27 49152]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 06:55 6731312]

C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-12-02 20:36:46 557568]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1B3DB89A-F5A7-49C8-BF26-6F10B83D7A27}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{CAF5073B-2C19-41EB-AFA8-AAC2F80610F7}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{7C1F7874-419E-449C-ABA3-2A41267545EA}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8CE5ED71-063D-4BC7-861F-0A37E574A459}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{E388FA1F-6269-4F6C-BE36-AFF381FA07D8}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{8C2A6BA2-9E61-453E-A645-1B8B201197C6}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{2E5EE33A-F57B-4696-984B-6C9F71FA04D1}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{F27363B1-1D4F-4291-94E0-D8FF95FCC853}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{480D15B6-AE2B-432C-8611-7771573631D2}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{C5E6FD5A-316F-42B5-8C65-977143777CAF}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{311E2913-5386-4280-A3FA-E8F35622BD85}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{55298B93-F4F2-47BC-A1DD-BE1BE9DCDE6B}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{A3C14A61-CC3D-4D10-8F49-61C2041D3941}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= UDP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare
"UDP Query User{D75C2FC2-88CB-411D-95FD-B9434C0FB37A}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= TCP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare
"TCP Query User{010F1C26-DD9E-4CBA-9204-FBAF67BD15A3}C:\\program files\\ares\\ares.exe"= UDP:C:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{88D2B9F7-E4FC-401E-9141-87B2161F2BCA}C:\\program files\\ares\\ares.exe"= TCP:C:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{3737C091-3163-4D2D-B3C2-A38FEB300D7D}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java™ Platform SE binary
"UDP Query User{AA91A095-9CB1-48E9-BC04-280F81E84000}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java™ Platform SE binary
"{ACCCBF33-236B-4E28-880C-09E4C89C86D0}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{D00121FC-70A6-4E43-9E58-F35A341C3A68}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{647E52C6-EB5D-4484-82AF-36E91D2B336E}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{522E0793-53A8-45B5-9DF0-CDE4856F251B}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 05:00]
R3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-01-19 01:03]
R3 VST_DPV;VST_DPV;C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 05:11]
R3 VSTHWATI;VSTHWATI;C:\Windows\system32\DRIVERS\VSTATI3.SYS [2006-11-02 05:11]
S0 OemBiosDevice;Royalty OEM BIOS Extension;C:\Windows\system32\DRIVERS\royal.sys [2007-03-02 10:49]
S2 ArcGIS License Manager;ArcGIS License Manager;C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1999-12-01 13:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-01 20:08:26 C:\Windows\Tasks\User_Feed_Synchronization-{082C516C-27E8-4410-9FB4-74962EC78A15}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-01 17:46:19
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-01 17:47:38
ComboFix-quarantined-files.txt 2008-04-01 20:17:32
ComboFix2.txt 2008-03-31 22:32:18
The system cannot find message text for message number 0x2379 in the message file for Application.
The system cannot find message text for message number 0x2379 in the message file for Application.
.
2008-03-26 09:38:18 --- E O F ---



--------------------------------------------------------------------------------------------------------
Here is the Hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:32:05 PM, on 3/31/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Users\Ryan\Program Files\DNA\btdna.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Ryan\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ryan.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Ryan\Program Files\DNA\btdna.exe"
O4 - HKLM\..\Policies\Explorer\Run: [HjfnwIoLfU] C:\ProgramData\rsnozato\vwvefena.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4583 bytes

[Rorschach112]

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Policies\Explorer\Run: [HjfnwIoLfU] C:\ProgramData\rsnozato\vwvefena.exe

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Reboot and post a new HijackThis log

[ryan38]

It wont let me save it as a text.... for some reason when i go to save it as a text on my desktop it says "for your computers security, this file has been saved in the temporary internet files folder" and then when i go to look there its not actually there?

[Rorschach112]

Strange

Can you post the HTML page here if you still have it ?

If you can't get it, do this


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan. Check all the boxes and click Start Scan
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[ryan38]

here is the first log


Malwarebytes' Anti-Malware 1.10
Database version: 584

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 104435
Time elapsed: 28 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 14
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\qvdntlmw.bfag (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\qvdntlmw.toolbar.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.1 (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\qvdntlmw.bfag (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\qvdntlmw.ToolBar.1 (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\QooBox\Quarantine\C\Windows\Web\def.htm.vir (Trojan.FakeAlert) -> No action taken.
C:\Users\Ryan\Desktop\OTScanIt\MovedFiles\03312008_184601\ProgramData\rsnozato\vwvefena.exe (Trojan.FakeAlert) -> No action taken.
C:\Users\Ryan\Desktop\OTScanIt\MovedFiles\03312008_184601\Windows\System32\zcbelebc.exe (Trojan.FakeAlert) -> No action taken.


---------------------------

HERE IS THE HIJACK LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:32:05 PM, on 3/31/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Users\Ryan\Program Files\DNA\btdna.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Ryan\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ryan.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Ryan\Program Files\DNA\btdna.exe"
O4 - HKLM\..\Policies\Explorer\Run: [HjfnwIoLfU] C:\ProgramData\rsnozato\vwvefena.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4583 bytes

[Rorschach112]

Just one thing remaining

We need to disable the AVG Anti-Spyware guard :

1. Open AVG Anti-Spyware by double-clicking the multi-colored box emblazoned with an 'S' in the system tray.
2. In the 'Resident Shield' section, toggle the AVG Anti-Spyware active protection 'off' by clicking 'Change state' which will then change the protection status to 'inactive'.
3. If you are instructed to reboot at any time during your cleanup, AVG Anti-Spyware will prompt you as to whether you would like to "Restart the Resident Shield".
4. Reply 'no' and set it to 'inactive' for the duration of your cleanup.




1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Policies\Explorer\Run: [HjfnwIoLfU] C:\ProgramData\rsnozato\vwvefena.exe

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Then delete this folder in bold


C:\ProgramData\rsnozato


Reboot and post a new HijackThis log

[ryan38]

when i open up AVG under the resident shield it says "N/A" and i can;t change it?

[Rorschach112]

No problem, just go on with the rest of the steps

[ryan38]

another quick question....


when i run Hijack a window comes up saying "For some reason your system denied write access to hosts file" then it goes on to say that if hijack cant fix it i will have to do it my self... is that an issue?

[Rorschach112]

Strange, not sure what is causing that. Try fix it with HijackThis after that if you can.

Try delete that folder as well

Tell me how that goes