[SternBern]

Hello, if anyone could help me deal with this pest, it would very much be appreciated.


Here's the logfile from HijackThis:

-----
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:37 AM, on 5/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\sopidkc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Administrator\reader_s.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.emurayden.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: C:\WINDOWS\system32\jkshfuiehi.dll - {c2ba40a1-74f3-42bd-f434-12345a2c8953} - C:\WINDOWS\system32\jkshfuiehi.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DRam prosessor] msupdate.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [XboxStat] "c:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunServices: [DRam prosessor] msupdate.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [uidenhiufgsduiazghs] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\o4zkn0juy.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Administrator\reader_s.exe
O4 - HKCU\..\Run: [Diagnostic Manager] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\2064148052.exe
O4 - HKCU\..\Run: [SYS32DLL] SYS32DLL
O4 - HKCU\..\Run: [] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\o4zkn0juy.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [svc] c:\program Files\ThunMail\testabd.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\Documents and Settings\Administrator\reader_s.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: add to evernote - res://C:\Program Files\Evernote\Evernote3\enbar.dll/2000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Add to Evernote - {e0b8c461-f8fb-49b4-8373-fe32e9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll
O9 - Extra 'Tools' menuitem: Add to Evernote - {e0b8c461-f8fb-49b4-8373-fe32e9252800} - C:\Program Files\Evernote\Evernote3\enbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O11 - Options group: [java_sun] Java (Sun)
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zon...1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: wbsys.dll,c:\progra~1\ThunMail\testabd.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: sdfsefsfdvdubgiungfuyd - {C2BA40A1-74F3-42BD-F434-12345A2C8953} - C:\WINDOWS\system32\jkshfuiehi.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dhcp server (dhcpsrv) - Unknown owner - C:\WINDOWS\dhcp\svchost.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (javaquickstarterservice) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: sopidkc Service (sopidkc) - Twain Working Grou - C:\WINDOWS\system32\sopidkc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10003 bytes
-------

Thanks again in advanced. Should there be anything else I need to post, please say so.

[handhfan]

Hello, SternBern, and welcome to GeeksToGo!

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  -----------------------------------------------------------
  
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    -----------------------------------------------------------
  
  
  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  
  -----------------------------------------------------------
  
• Double click on combofix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[SternBern]

Hi! Thanks for the reply, but I'm afraid I have some bad news. It downloads and runs flawlessly and then it says something along the lines of:

"!! ALERT !! It is NOT safe to continue it may have been compromised.

Please visit (bleedingcomputer url) to download a clean copy, you may have a virut."

EDIT:

Sorry, but I'm not sure what to do from here on out. Maybe a complete wipe would be best? I've all ready tried doing a system restore, but no go, I guess this worm stops the computer from shutting down unless the user logs off and THEN hits shut down from the user list.

[handhfan]

• Make sure to use Internet Explorer for this
  
• Please go to VirSCAN.org FREE on-line scan service
  
• Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
  
  
  • C:\WINDOWS\System32\svchost.exe
  
  
  
• Click on the Upload button
  
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  
• Paste the contents of the Clipboard in your next reply.

Do the same for the following files:

C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winlogon.exe

[SternBern]

Heya, I don't have Internet Explorer on this machine for some reason (it used to belong to my friend, I'm sure he is to blame), so instead of copying the log (which im sure you know firefox won't let me do, and is why I think you told me to use IE for), I took the liberty of taking screen shots, if that's OK with you.


svchost.exe scan:




explorer.exe scan:




winlogon.exe scan:




Hi, sorry if this doesn't really help, but it was all I could come up with at this time. Thanks, again.

[handhfan]

That's fine.

Not the results I expected to see. One more file, just out of curiosity. Send the saved ComboFix.exe file through VirScan as well.

[SternBern]

Hah, that's funny, this is starting to get curious. I think the virus automatically attaches to ComboFix.exe.
One sec, it's still scanning...


Oh my god...

combofix.exe:

[handhfan]

No, that's nothing unusual, that's standard false positives for such a powerful tool as ComboFix is. Only odd thing is that you are unable to run it.

Well, in that case, we'll need to go about this differently.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
  
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
  
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  
• Press any Key and it will restart the PC.
  
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

• Download OTListIt2 to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

[SternBern]

Hello, apparently what happened when I tried to go into safe mode was that the computer completely stopped working, it would always give me a blue screen, so I had to reinstall Windows. This, I think, was bound to happen anyways. Thanks for the help, I appreciate everything you did to try and help, but alas what's done is done. I didn't lose anything important, which is good, all of the files that I needed were on a back-up, and have been scanned and there are no infections what so ever. I'm going to run ComboFix tomorrow morning just to see if anything went wrong. If there is anything else I should do to help protect my computer, please say so.

Thanks again!

EDIT:

Here's the ComboFix Log:


ComboFix 09-05-12.06 - Owner 05/13/2009 10:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.704 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb

.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 07:07 . 2009-05-13 07:07 -------- d-----w c:\program files\Paint.NET
2009-05-13 07:07 . 2009-05-13 07:07 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Paint.NET
2009-05-13 06:48 . 2009-05-13 06:48 -------- d-----w c:\documents and settings\All Users\Application Data\Macrovision
2009-05-13 06:47 . 2009-05-13 06:47 -------- d-----w c:\program files\Common Files\Adobe Systems Shared
2009-05-13 06:46 . 2009-05-13 06:47 -------- d-----w c:\program files\Common Files\Adobe
2009-05-13 06:45 . 2009-05-13 06:45 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-13 06:08 . 2009-05-13 06:08 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Evernote
2009-05-13 06:08 . 2009-05-13 06:08 -------- d-----w c:\program files\Evernote
2009-05-13 06:08 . 2009-05-13 06:46 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-13 06:07 . 2009-05-13 06:07 -------- d-----w c:\documents and settings\Owner\Application Data\InstallShield
2009-05-13 06:04 . 2009-05-13 06:04 4212 ---ha-w c:\windows\system32\zllictbl.dat
2009-05-13 06:04 . 2009-02-16 05:10 1221512 ----a-w c:\windows\system32\zpeng25.dll
2009-05-13 05:31 . 2009-05-13 13:02 -------- d-----w c:\documents and settings\Owner\Application Data\foobar2000
2009-05-13 05:31 . 2009-05-13 05:35 -------- d-----w c:\program files\foobar2000
2009-05-13 05:12 . 2009-05-13 05:12 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-13 05:09 . 2009-05-13 05:09 -------- d-----w c:\windows\nview
2009-05-13 05:09 . 2009-03-27 15:03 453152 ----a-w c:\windows\system32\nvudisp.exe
2009-05-13 05:09 . 2009-03-27 13:14 453152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-05-13 05:08 . 2009-05-13 05:08 -------- d-----w C:\NVIDIA

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 06:04 . 2009-05-13 06:04 -------- d-----w c:\program files\Zone Labs
2009-05-13 05:41 . 2009-05-13 05:41 -------- d-----w c:\program files\RocketDock
2009-05-13 05:38 . 2009-05-13 04:17 35536 ----a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-13 04:39 . 2009-05-13 04:38 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-13 04:33 . 2009-05-13 04:33 -------- d-----w c:\program files\C-Media
2009-05-13 04:25 . 2009-05-13 04:24 -------- d-----w c:\program files\Unlocker
2009-05-13 04:25 . 2009-05-13 04:25 -------- d-----w c:\program files\MediaLooks
2009-05-13 04:25 . 2009-05-13 04:25 -------- d-----w c:\program files\QuickTime Alternative
2009-05-13 04:24 . 2009-05-13 04:24 -------- d-----w c:\program files\K-Lite Codec Pack
2009-05-13 04:24 . 2009-05-13 04:24 -------- d-----w c:\program files\7-Zip
2009-05-13 04:24 . 2009-05-13 04:24 -------- d-----w c:\program files\Foxit Software
2009-05-13 04:23 . 2009-05-13 04:22 -------- d-----w c:\program files\Windows Live
2009-05-13 04:23 . 2009-05-13 04:23 -------- d-----w c:\program files\Microsoft
2009-05-13 04:23 . 2009-05-13 04:23 -------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2009-05-13 04:23 . 2009-05-13 04:23 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-13 04:23 . 2009-05-13 04:23 -------- d-----w c:\program files\Java
2009-05-13 04:22 . 2009-05-13 04:22 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-13 04:18 . 2009-05-13 04:18 94248 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-13 04:18 . 2009-05-13 04:18 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-13 04:17 . 2009-05-13 04:17 0 ----a-w c:\windows\nsreg.dat
2009-05-13 04:17 . 2009-05-13 04:17 -------- d-----w c:\program files\MSBuild
2009-05-13 04:17 . 2009-05-13 04:17 -------- d-----w c:\program files\Reference Assemblies
2009-05-13 04:10 . 2008-04-14 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-13 04:10 . 2009-05-13 04:10 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-13 04:09 . 2009-05-13 04:09 -------- d-----w c:\program files\Windows Media Connect 2
2009-05-13 04:07 . 2009-05-13 04:07 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-13 04:06 . 2009-05-13 04:06 -------- d-----w c:\program files\MSXML 4.0
2009-05-13 04:05 . 2009-05-13 04:05 -------- d-----w c:\program files\Microsoft Silverlight
2009-04-20 19:38 . 2009-05-13 04:14 12998 ----a-w c:\documents and settings\Custom Settings\IE Favorite Links.bat
2009-04-20 18:32 . 2009-04-20 18:32 3186 ----a-w c:\windows\system32\presetup.cmd
2009-04-20 18:32 . 2009-04-20 18:32 28672 ----a-w c:\windows\system32\setupold.exe
2009-04-20 18:32 . 2009-04-20 18:32 13976 ----a-w c:\windows\system32\drivers\viaide.sys
2009-04-20 18:25 . 2009-04-20 18:25 361600 ----a-w c:\windows\system32\drivers\tcpip.sys
2009-04-20 18:23 . 2009-05-13 04:06 81768 ----a-w c:\windows\system32\xinput1_3.dll
2009-04-20 18:22 . 2009-04-20 18:22 24576 ----a-w c:\windows\system32\nlsdl.dll
2009-04-20 18:21 . 2009-05-13 04:06 922112 ----a-w c:\windows\system32\imapi2fs.dll
2009-04-20 18:21 . 2009-05-13 04:06 426496 ----a-w c:\windows\system32\imapi2.dll
2009-04-20 18:21 . 2009-04-20 18:21 151552 ----a-w c:\windows\system32\ifxcardm.dll
2009-04-20 18:21 . 2009-04-20 18:21 26112 ----a-w c:\windows\system32\idndl.dll
2009-04-20 18:21 . 2009-04-20 18:21 633344 ----a-w c:\windows\system32\gpprefcl.dll
2009-04-20 18:21 . 2009-04-20 18:21 249856 ----a-w c:\windows\system32\drmupgds.exe
2009-04-20 18:21 . 2009-04-20 18:21 133632 ----a-w c:\windows\system32\drivers\exfat.sys
2009-04-20 18:21 . 2009-05-13 04:06 4178264 ----a-w c:\windows\system32\D3DX9_41.dll
2009-04-20 18:21 . 2009-05-13 04:06 4379984 ----a-w c:\windows\system32\D3DX9_40.dll
2009-04-20 18:21 . 2009-05-13 04:06 3851784 ----a-w c:\windows\system32\D3DX9_39.dll
2009-04-20 18:21 . 2009-05-13 04:06 3850760 ----a-w c:\windows\system32\D3DX9_38.dll
2009-04-20 18:19 . 2009-04-20 18:19 96792 ----a-w c:\windows\system32\basecsp.dll
2009-04-20 18:18 . 2009-04-20 18:18 32384 ----a-w c:\windows\system32\drivers\usbccgp.sys
2009-04-20 18:17 . 2009-04-20 18:17 45568 ----a-w c:\windows\system32\mshta.exe
2009-04-20 18:16 . 2009-04-20 18:16 94208 ----a-w c:\windows\system32\eappgnui.dll
2009-04-20 18:14 . 2009-04-20 18:14 1153 ----a-w c:\windows\system32\nlite.cmd
2009-04-20 17:04 . 2009-05-13 04:14 31052 ----a-w c:\documents and settings\Custom Settings\System Settings.reg
2009-04-20 11:46 . 2009-05-13 04:14 30813 ----a-w c:\documents and settings\Custom Settings\User Settings.reg
2009-04-19 23:23 . 2009-05-13 04:14 2677 ----a-w c:\documents and settings\Custom Settings\User Settings.bat
2009-04-19 14:39 . 2009-05-13 04:14 4466 ----a-w c:\documents and settings\Custom Settings\Auto Config.bat
2009-04-18 12:18 . 2009-05-13 04:14 2419 ----a-w c:\documents and settings\Custom Settings\System Settings.bat
2009-04-18 11:21 . 2009-05-13 04:14 653 ----a-w c:\documents and settings\Custom Settings\IExpress Shortcut Creator.vbs
2009-04-17 23:32 . 2009-05-13 04:14 1086 ----a-w c:\documents and settings\Custom Settings\WMP Shortcut Creator.vbs
2009-03-23 10:55 . 2009-03-23 10:55 576512 ----a-w c:\windows\system32\drivers\ntfs.sys
2009-03-02 18:10 . 2009-05-13 04:24 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-26 20:47 . 2009-05-13 04:24 2255360 ----a-w c:\windows\system32\x264vfw.dll
.

------- Sigcheck -------

[-] 2009-04-20 18:25 361600 BA8C046D98345129723E6BCAA1E8AB99 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-13 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2002-07-12 1581056]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-03-27 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-04-20 128512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-13 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

S4 Abiotct_cmms;Abiotct_cmms; [x]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SRESCAN
*NewlyCreated* - VSMON
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Add to Evernote - c:\program files\Evernote\Evernote3\enbar.dll/2000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0bjbvc3u.default\
FF - component: c:\program files\Evernote\Evernote3\FfTbClipper\components\enbar3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 10:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-13 10:12
ComboFix-quarantined-files.txt 2009-05-13 15:12

Pre-Run: 72,061,165,568 bytes free
Post-Run: 72,121,954,304 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

175


I've installed Zone Alarm on here, and I'm pretty sure I'm going to need more things, do you have any recommendations for anti-virus or anti-spyware programs?

[handhfan]

Your logs look clean. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. If you have any questions or other problems, please let me know. Other than that, and the steps below, you should be all set.

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Click START then RUN
  
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  

Please update Adobe Reader, by downloading and installing Adobe Reader 9.1.

You should also have ONE good firewall. Here are 3 free ones available for personal use:

• Sunbelt-Kerio Firewall
  
• Comodo Free Firewall
  
• ZoneAlarm

and ONE good antivirus (these are also free for personal use):

• AVG Anti-Virus
  
• Avast Home Edition
  
• Anti-Vir

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

• SpywareBlaster to help prevent spyware from installing in the first place.
  
• SpywareGuard gives you realtime protection from spyware.
  
• Super Antispyware OR Malwarebytes' Anti-Malware to help remove any spyware that may have gotten on your computer.
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed.
  
• Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see this article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

To keep your operating system up to date visit Microsoft Windows Update monthly. Remember to be aware of what emails you open and websites you visit.

Have a safe and happy computing day!

[SternBern]

Thanks SO much for the help, I really appreciate it.

I've downloaded Zone Alarm, Avast!, and the rest of the programs you told me to do. This time, I'll make sure nothing gets in here.

Again, thanks a bunch for helping.

[handhfan]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.