Virus Alarm: Adir.dll and possibly others... Help!

[gi0vana]

It all started because of that darn RollerCoaster Tycoon 3 :oops:

... Then came a virus that evolved into pure mayhem!

The darned thing (virus) has been detected by Avast over and over again, but can't be touched (of course!). Nothing works! I even deleted it in Safe Mode, but it came back safe and sound on the next boot.

Now, running in Normal Mode is out of the question, so is installing anti-spyware programs, since they don't install in Safe Mode.

HighjackThis works, but I see nothing that rings the bell... from a layman(woman) point of view.

So, it's time for you guys to give me a light...

I hope someone can help (and sorry to make you read all of this list) :sad:

Logfile of HijackThis v1.99.1
Scan saved at 00:13:51, on 28/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\Arquivos de programas\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\ctfmon.exe
F:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yanghe.be/18/18.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=552...cid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - F:\Documents and Settings\All Users\Dados de aplicativos\Prevx\pxbho.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - F:\Arquivos de programas\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Arquivos de programas\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\arquivos de programas\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - F:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - F:\Arquivos de programas\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Arquivos de programas\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\arquivos de programas\google\googletoolbar2.dll
O4 - HKLM\..\Run: [HTpatch] F:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] F:\ARQUIV~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Arquivos de programas\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Cool Find] C:\Program Files\Cool Find\cfhooker.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [PrevxOne] "F:\Arquivos de programas\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [RoboForm] "F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [STYLEXP] F:\Arquivos de programas\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Nektra OEAPI] "F:\Arquivos de programas\Mailinfo\Mailinfo for Outlook Express\oe_mailinfo.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = F:\Arquivos de programas\Arquivos comuns\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Acrobat Assistant.lnk = F:\Arquivos de programas\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - F:\Arquivos de programas\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - F:\Arquivos de programas\DAP\dapextie.htm
O8 - Extra context menu item: Barra de Ferramentas do RF - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Download &all with DAP - F:\Arquivos de programas\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Personalizar Menu - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Preencher - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Salvar Formulários - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Arquivos de programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Arquivos de programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Preencher - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Preencher - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Salvar - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Salvar Formulários - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barra de Ferramentas do RF - {724d43aa-0d85-11d4-9908-00400523e39a} - file://F:\Arquivos de programas\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200605...ex/qtplugin.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst_current.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://zyoncore.com.br/sigi/websigi2/ImageUploader3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...5/installer.exe
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B26EF5A7-8581-4510-B047-AFF08413C8BB}: NameServer = 200.219.150.4,200.219.150.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: schmap-help - {2CF664A0-5EA6-47B5-884C-433A60145F78} - F:\Arquivos de programas\Schmap\Schmap Player\SchmapDocLib.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - F:\Arquivos de programas\Arquivos comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - F:\Arquivos de programas\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - F:\Arquivos de programas\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - F:\Arquivos de programas\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - F:\Arquivos de programas\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - F:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - F:\Arquivos de programas\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: StyleXPService - Unknown owner - F:\Arquivos de programas\TGTSoft\StyleXP\StyleXPService.exe

[gi0vana]

Well,

I'm sure you guys were very busy helping other dozens (maybe hundreds) of desperate pc-users, so I decided to help myself and research. My friends, I won the battle! :yahoo:

It didn't take more than a few minutes, after I found the right weapon.

Here's my very successful drill:

Running Windows in Safe Mode I...

1. Downloaded SDFix.zip (http://downloads.andymanchesta.com/RemovalTools/SDFix.zip)
2. Unziped it to pre-assigned folder
3. Clicked twice on Runthis.bat
4. Follow the instructions on screen (simplest ever -just type Y and wait)
5. After a while, SDFix restarted my computer (it wen't straight to Normal Mode, which was already a victory in itself)
7. A few more minutes of wait till SDFix worked its magic and...
6. Voilá! I was bug-free again!

I had read about a thousand posts (very long ones) on how to fix this virus, to end up fixing it with only one tiny program! :thud:
SDFix.zip was an angel in software disquise! So simple and fast...

After that, I installed the latest version of AVG Anti-Spyware, which detected another 26 dorment viruses on my PC (ouch!), cleaned them all and right now I'm running 3 (three!) anti-virus appz...

Thank you all! :greeting:

gi0vana

[pskelley]

Welcome to the forum and you go gi0vana:bigthumb: I saw some junk in the HJT log you posted, but the item SDFix removed must have been hidden. I use the tool often, if you want me to take a look to make sure the HJT log is clean or if you have any questions about the AVG Anti-Spyware scan report, post those and I will be glad to advise you. If you are sure you have no problems, then I suggest you do this.
System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

If you have an interest in learning more about this process, let me know and I will direct you to free online training.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[tashi]

Cheers. :bigthumb:

As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.