[Rorschach112]

hi

1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to move:
C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\hkcmd.exe | C:\Windows\System32\hkcmd.exe
C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\igfxpers.exe | C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe | C:\Windows\System32\ndstray.exe
C:\Windows\System32\DriverStore\FileRepository\hdart.inf_f4fbd5c9\RtHDVCpl.exe | C:\Windows\System32\rthdvcpl.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply

[Advertisements]

Hi Rorschach112,

Thank you so much for the fast response. The log from avenger as below:-

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\hkcmd.exe|C:\Windows\System32\hkcmd.exe" completed successfully.
File move operation "C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\igfxpers.exe|C:\Windows\System32\igfxpers.exe" completed successfully.
File move operation "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe|C:\Windows\System32\ndstray.exe" completed successfully.
File move operation "C:\Windows\System32\DriverStore\FileRepository\hdart.inf_f4fbd5c9\RtHDVCpl.exe|C:\Windows\System32\rthdvcpl.exe" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Attached Files

•  avenger.txt   2.04KB   73 downloads

[leo1980]

Hi Rorschach112,

Thank you so much for the fast response. The log from avenger as below:-

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\hkcmd.exe|C:\Windows\System32\hkcmd.exe" completed successfully.
File move operation "C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_7d052dd0\igfxpers.exe|C:\Windows\System32\igfxpers.exe" completed successfully.
File move operation "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe|C:\Windows\System32\ndstray.exe" completed successfully.
File move operation "C:\Windows\System32\DriverStore\FileRepository\hdart.inf_f4fbd5c9\RtHDVCpl.exe|C:\Windows\System32\rthdvcpl.exe" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Attached Files

•  avenger.txt   2.04KB   73 downloads

[Rorschach112]

open OTL click the none button, paste this in the custom scan box

/md5start
hkcmd.exe
igfxpers.exe
ndstray.exe
rthdvcpl.exe
/md5stop


click run scan post that log

[leo1980]

Hi Rorschach112,

My log as below:-

OTL logfile created on: 1/9/2010 8:47:51 AM - Run 3
OTL by OldTimer - Version 3.1.20.2 Folder = C:\Users\admin\Desktop\VirusProtection
Windows Vista Business Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16945)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 41.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.57 Gb Total Space | 43.29 Gb Free Space | 41.01% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 8.47 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 968.25 Mb Total Space | 966.30 Mb Free Space | 99.80% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADMIN-PC
Current User Name: admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Custom Scans ==========



< MD5 for: HKCMD.EXE >
[2007/03/29 13:32:24 | 00,154,392 | ---- | M] (Intel Corporation) MD5=B9D2CCA0069B40AF6F1DFE61D13DA801 -- C:\TOSAPINS\Intel-Display-Driver\Graphics\hkcmd.exe
[2007/03/29 13:32:24 | 00,154,392 | ---- | M] (Intel Corporation) MD5=B9D2CCA0069B40AF6F1DFE61D13DA801 -- C:\Windows\System32\hkcmd.exe

< MD5 for: IGFXPERS.EXE >
[2007/03/29 13:32:38 | 00,133,912 | ---- | M] (Intel Corporation) MD5=C73E8138479670609869BE079AD4B618 -- C:\TOSAPINS\Intel-Display-Driver\Graphics\igfxpers.exe
[2007/03/29 13:32:38 | 00,133,912 | ---- | M] (Intel Corporation) MD5=C73E8138479670609869BE079AD4B618 -- C:\Windows\System32\igfxpers.exe

< MD5 for: NDSTRAY.EXE >
[2006/11/15 13:02:36 | 01,372,160 | ---- | M] (TOSHIBA CORPORATION) MD5=93225E495B790822039F561839529B0B -- C:\Windows\System32\ndstray.exe

< MD5 for: RTHDVCPL.EXE >
[2007/03/14 15:50:24 | 04,399,104 | ---- | M] (Realtek Semiconductor) MD5=5D9A8DA947D1015E70C85FDEE802785D -- C:\Program Files\Realtek\InstallShield\RtHDVCpl.exe
[2007/03/14 15:50:24 | 04,399,104 | ---- | M] (Realtek Semiconductor) MD5=5D9A8DA947D1015E70C85FDEE802785D -- C:\TOSAPINS\Realtek-Audio-Driver\Vista\RtHDVCpl.exe
[2007/03/14 15:50:24 | 04,399,104 | ---- | M] (Realtek Semiconductor) MD5=5D9A8DA947D1015E70C85FDEE802785D -- C:\Windows\RtHDVCpl.exe
[2007/03/14 15:50:24 | 04,399,104 | ---- | M] (Realtek Semiconductor) MD5=5D9A8DA947D1015E70C85FDEE802785D -- C:\Windows\System32\rthdvcpl.exe
< End of report >

[Rorschach112]

need you to do this part once more

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[leo1980]

Hi Rorschach112,

My logs from Malwarebytes and Kapersky as below:

Malwarebytes' Anti-Malware 1.44
Database version: 3526
Windows 6.0.6000
Internet Explorer 7.0.6000.16945

1/9/2010 11:22:15 PM
mbam-log-2010-01-09 (23-22-15).txt

Scan type: Quick Scan
Objects scanned: 125433
Time elapsed: 8 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Internet Explorer\wmpscfgs.exe (Trojan.Agent) -> Quarantined and deleted successfully.


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, January 10, 2010
Operating system: Microsoft Windows Vista Business Edition, 32-bit (build 6000)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, January 09, 2010 16:31:31
Records in database: 3301690
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 126123
Threats found: 4
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 02:50:04


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\Windows\System32\drivers\iaStor.sys.vir Infected: Rootkit.Win32.TDSS.y 1
C:\Qoobox\Quarantine\C\Windows\System32\ndstray .exe.vir Infected: Trojan.Win32.Cosmu.jnh 1
C:\Qoobox\Quarantine\C\Windows\System32\rthdvcpl .exe.vir Infected: Trojan.Win32.Cosmu.jnh 1
C:\Users\admin\AppData\Local\VirtualStore\Windows\System32\secupdat.dat Infected: Backdoor.Win32.Cetorp.p 1
C:\Users\admin\Desktop\Newdownloads\MPC-6.4.9.exe Infected: not-a-virus:AdWare.Win32.Agent.lmz 1

Selected area has been scanned.

[Rorschach112]

hi

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  
  :Services
  
  :Reg
  
  :Files
  C:\Users\admin\AppData\Local\VirtualStore\Windows\System32\secupdat.dat
  C:\Users\admin\Desktop\Newdownloads\MPC-6.4.9.exe
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [Reboot]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Please download Dr.Web CureIt . Save it to your desktop:

• Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
• This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, select Complete scan.
• Click the green arrow at the right, and the scan will start.
• Click Yes to all if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click File and choose Save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
• Please post the Dr.Web.txt report in your next reply
• Close Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.

[leo1980]

Hi Rorschach112,

My OTM log as below. I have completed the scan from Drweb Cureit but mysystem crash when i am trying to generate and save the report. Thus, guess i need to rescan again.

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Users\admin\AppData\Local\VirtualStore\Windows\System32\secupdat.dat moved successfully.
C:\Users\admin\Desktop\Newdownloads\MPC-6.4.9.exe moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: admin
->Temp folder emptied: 92607437 bytes
->Temporary Internet Files folder emptied: 13041896 bytes
->Java cache emptied: 3144759 bytes

User: All Users

User: Cedric
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Yan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48446 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 249899603 bytes

Total Files Cleaned = 342.00 mb


OTM by OldTimer - Version 3.1.5.0 log created on 01102010_215959

Files moved on Reboot...
File move failed. C:\Windows\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[Rorschach112]

if it crashes again you can leave it

[leo1980]

Hi Rorschach112,

My system crash again after I trying to save the report.

[Rorschach112]

hows the pc running

[leo1980]

Hi Rorschach112,

Sorry for the late reply, what you mean by how's the pc running? Below is my log for OTM, I am unable to save the report for DrWebCureit.

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Users\admin\AppData\Local\VirtualStore\Windows\System32\secupdat.dat moved successfully.
C:\Users\admin\Desktop\Newdownloads\MPC-6.4.9.exe moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: admin
->Temp folder emptied: 92607437 bytes
->Temporary Internet Files folder emptied: 13041896 bytes
->Java cache emptied: 3144759 bytes

User: All Users

User: Cedric
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Yan
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48446 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 249899603 bytes

Total Files Cleaned = 342.00 mb


OTM by OldTimer - Version 3.1.5.0 log created on 01102010_215959

Files moved on Reboot...
File move failed. C:\Windows\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[Rorschach112]

as in, do you have any redirects ?

[leo1980]

Hi Rorschach112,

I have just randomly checked my internet. I am very glad to realise no redirects upon checking..Thank you so much for ur help..But is there any final scan that I can do for any virus or faulty registry?

[Rorschach112]

Your logs are clean


Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

• Download OTC to your desktop and run it
• Click Yes to beginning the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  
• Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
  secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
  blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
  Here
  
  
  If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  
  
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  
  
• Please read my guide on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.