Unable to Remove Win32.Murlo.ff

[bigstu4024]

Spybot has detected Win32.Murlo.ff I choose to fix the selected problem but when I restart the computer it reappears. I have run Spybot in safemode with System Restore off but Win32.Murlo.ff still reappears. Symptoms include browser redirects with Internet Explorer and Firefox is unable to download and shuts down on its own. Also at times the google search only returns results for weird websites. In addition, sometimes in Firefox google appears in Russian. I am unable to do the internet virus scan suggested in "Read This First" thread. Here is the hijack this log. The log is taken from after I have scanned and fixed the problem with spybot. The problem will return when I reboot. Any help would be greatly appreciated. Thanks:crowned:

Logfile of HijackThis v1.99.1
Scan saved at 5:21:50 PM, on 7/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Steve\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53B5F2B1-94DD-43E5-8187-EB4E31F00701} - C:\WINDOWS\voxafgzs.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [gf1.0.0.2] C:\WINDOWS\kpivcpqz.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180748204325
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180748184677
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{29604103-F9C0-44EC-B7A6-EE0731C58F7F}: NameServer = 194.54.90.226
O17 - HKLM\System\CCS\Services\Tcpip\..\{2EC00DBF-CCC8-440B-8B36-2BA1620917AD}: NameServer = 194.54.90.226
O17 - HKLM\System\CCS\Services\Tcpip\..\{56C3CE7C-FECE-4B89-9E31-502F15AF49F2}: NameServer = 194.54.90.226
O17 - HKLM\System\CCS\Services\Tcpip\..\{F16B5368-EE08-4324-ADAD-810095759647}: NameServer = 194.54.90.226
O17 - HKLM\System\CCS\Services\Tcpip\..\{F25E1B37-EE3F-4EF3-8DFA-D9B7E1417247}: NameServer = 64.136.173.5 64.136.164.77
O17 - HKLM\System\CS1\Services\Tcpip\..\{29604103-F9C0-44EC-B7A6-EE0731C58F7F}: NameServer = 194.54.90.226
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: ipv7 - Unknown owner - C:\WINDOWS\ipv7.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information. "BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Can you tell me if this is valid for you?
http://whois.domaintools.com/194.54.90.226
says clear, but the Ukraine is usually hackers.

You have several trojans, this one I can identify: C:\WINDOWS\ipv7.exe
and it is nasty: http://www.bleepingcomputer.com/startups/ipv7.exe-16220.html
http://www.sophos.com/security/analyses/w32sdbotfao.html
Allows others to access the computer
Downloads code from the internet
Installs itself in the Registry
Exploits system or software vulnerabilities
Used in DOS attacks

http://fileinfo.prevx.com/adware/qqe54843628702-IPV725441069/IPV7.EXE.html
Installs programs.
Deletes programs.
Invokes dll components.
Runs other programs.
Communicates with web sites using httpout protocols.
Communicates with other computers across the web.
Has outbound communications.Creates known malware.
Creates copies of itself.

A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

Please let us know what you have decided to do in your next post.

Thanks

[bigstu4024]

Thanks for your work. I have read and understood the "Before You Post" Post.
In regards to the question:
"Can you tell me if this is valid for you?
http://whois.domaintools.com/194.54.90.226
says clear, but the Ukraine is usually hackers. "
I'm not sure what "valid" means in this context. I have never with my knowledge chosen to go to that address nor have I seen that address before, so if I am being connected to it then I agree that it is probably Ukrainian Hackers. I read that some hackers have begun to use google advertisements as a gateway. The problem began when I clicked on a google add link. The symptoms began shortly after and I found that my firewall had been disabled.
It wasn't that long ago that I installed the current operating system on a fresh hard drive so my plan of action will be to backup my documents and preform a reformat and reinstall. Is it certain that a reformat will completely wipe the hard drive clean? Thanks again.:bigthumb:

[pskelley]

The problem began when I clicked on a google add linkhttp://www.theregister.com/2007/05/11/google_malware_map/
http://redtape.msnbc.com/2007/05/the_next_net_th.html

If you have no reason to be connecting to an address in the Ukraine, it is probably bad. We know the normal numbers they use, here is a topic:
http://forums.spybot.info/showthread.php?t=16324 showing those number in the Fixwareout scan:
http://whois.domaintools.com/85.255.116.68 and this Blacklist is clear also so they must be changing numbers. I personally believe they are members of organized crime who deal in stolen information.

I can remove the junk and do all of the time, we just can not be sure something does not remaim hidden that will compromise your security. Here is some information that may help with your decision.

http://spyware-free.us/tutorials/reformat/
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://helpdesk.its.uiowa.edu/windows/instructions/reformat.htm

Thanks

[pskelley]

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.