PDA

View Full Version : Struggling with Virtumonde/Virtumonde.Generic



Dantegirl
2007-09-28, 06:57
Hi there
I have been trying to fix this problem for the last 6 days now, and being a novice in this field, am willing to admit defeat. I have Spybot v1.4 and it is reporting that I have the trojan virtumonde and virtumonde.generic, I guess causing pop ups and a slowing down of my computer. I have also had Symantec antivirus report that it has found the trojan.vundo which they say is also the virtumonde virus so using their removal tools have tried to remove it, but to no avail. Their removal tool did say that it may be hidden in the ieexplorer.exe file but I don't know what to do with that info. It seems to be clear when Spybot fixes it, but as soon as I connect to the internet again, i get the pop ups and virtumonde is found again when I run spybot.

Here is the Kaspersky log:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, September 28, 2007 2:27:37 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 28/09/2007
Kaspersky Anti-Virus database records: 424377
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 77084
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 02:50:02

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0c6f7a485863f047a10679fa0ea49c0a_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1653505d62ec5deee4c754d2cd05135b_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\276e12e86c38514c0315d3e775b82192_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2f540b28914e6163b89913537facdae1_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\372fcd74630578fd23b06d337311d43f_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5107d4cb49b6ca73b1ce9c28241eb27d_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\67ecb372df73822859b2cb4de8dadb6d_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6a3b9c12e5394dbf0eadcce6ff346991_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a9846546a852ed202590ffab29229c3b_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa519a80e6f5e2c113bc219fbdf53dec_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c71481118409e0e84d908d9c818b8941_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c9a69d0bf7ec2299883334b60f77e421_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d07402fca775c917a1269dcb4e554a66_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e178c96a8a842e9110d8055827d74586_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e9eb260bfbafb0caf58e7e02ffa001f9_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f04460cd6e62263f7b366c45960fe2e2_a41a77c4-8bc4-4c4c-8284-1b18340ec171 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\Christine\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Christine\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Christine\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Christine\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Christine\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\khfcdca.dll Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Here is the HJT log (there was an error when I first tried to run it but it seemed to sort itself out after a few tries)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:28:32 p.m., on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://wwp.greenwichmeantime.com/time-zone/north-america/canada/nova-scotia/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P30 "EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [FolderView] rundll32.exe "C:\WINDOWS\system32\mgauadjd.dll",sitypnow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164000732946
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164058878906
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6172 bytes

I place my computer in your hands...

steamwiz
2007-09-29, 20:00
HI

Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
1. Double-click VundoFix.exe to run it.
2. When VundoFix re-opens, click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click "YES".
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will reboot your computer, click "OK".

7. Please post the contents of C:\vundofix.txt
If vundofix cannot delete a file, it will try to delete it during a reboot, after the reboot vundofix will open again, you must run vundofix again, from "Click the Scan for Vundo button" ... and you must keep running vundofix until it does delete the file... I've known a stubborn vundo file take 5 or 6 reboots before it is deleted...

Keep running vundofix untill it gives you the message "no infected files were found"

THEN ...

Please download Combofix: http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
and save to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.

Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.

so please post :-

1. C:\vundofix.txt
2. C:\ComboFix.txt
3. a new hijackthis log (run after the other 2 programs)

steam

Dantegirl
2007-09-30, 01:38
Hi Steam
Thank you so much for helping me ( I know just enough about computers to get me into trouble and thats about it!)
Here are the logs you requested - the vundofix had to reboot 5 times so I guess it was a stubborn one!


VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 2:09:45 p.m. 25/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\bcbeg.tmp
C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\udmxkqyc.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\bcbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.tmp
C:\WINDOWS\system32\bcbeg.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\udmxkqyc.dll
C:\WINDOWS\system32\udmxkqyc.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\bcbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\udmxkqyc.dll
C:\WINDOWS\system32\udmxkqyc.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 2:33:00 p.m. 25/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.bak1
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\evdkxsux.dll
C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\tvsehkbc.dll
C:\WINDOWS\system32\xusxkdve.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.bak1
C:\WINDOWS\system32\bcbeg.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\evdkxsux.dll
C:\WINDOWS\system32\evdkxsux.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\tvsehkbc.dll
C:\WINDOWS\system32\tvsehkbc.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\xusxkdve.ini
C:\WINDOWS\system32\xusxkdve.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 5:25:21 p.m. 26/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\bcbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 7:12:23 p.m. 27/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini2
C:\WINDOWS\system32\bcbeg.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Could not be deleted.

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 9:48:00 a.m. 30/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\ettybveh.dll
C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\ltvgbogx.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.bak2
C:\WINDOWS\system32\bcbeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ettybveh.dll
C:\WINDOWS\system32\ettybveh.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\ltvgbogx.dll
C:\WINDOWS\system32\ltvgbogx.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 10:08:29 a.m. 30/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 10:19:08 a.m. 30/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 10:27:49 a.m. 30/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 10:36:16 a.m. 30/09/2007

Listing files found while scanning....

C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\gebcb.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bcbeg.ini
C:\WINDOWS\system32\bcbeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebcb.dll
C:\WINDOWS\system32\gebcb.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.9

Checking Java version...

Sun Java not detected
Scan started at 10:48:20 a.m. 30/09/2007

Listing files found while scanning....

No infected files were found.

The Combofix Log

ComboFix 07-09-30.3 - Christine 2007-09-30 11:02:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.202 [GMT 13:00]
Running from: C:\Documents and Settings\Christine\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\djdauagm.ini
C:\WINDOWS\system32\evdkxsux.dll
C:\WINDOWS\system32\ghkymchs.ini
C:\WINDOWS\system32\ltvgbogx.dll
C:\WINDOWS\system32\mgauadjd.dll
C:\WINDOWS\system32\shcmykhg.dll
C:\WINDOWS\system32\xgobgvtl.ini

.
((((((((((((((((((((((((( Files Created from 2007-08-28 to 2007-09-29 )))))))))))))))))))))))))))))))
.

2007-09-30 11:01 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-29 22:03 11,840 --------- C:\WINDOWS\system32\ettybveh.dll
2007-09-28 22:03 11,840 --a------ C:\WINDOWS\system32\albcyuoa.dll
2007-09-28 16:24 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-27 22:04 11,840 --a------ C:\WINDOWS\system32\tpmfespk.dll
2007-09-26 21:59 11,840 --a------ C:\WINDOWS\system32\kcrlsoyr.dll
2007-09-25 17:58 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-09-25 17:58 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-09-25 17:58 <DIR> d-------- C:\Program Files\Symantec
2007-09-25 17:32 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-09-25 15:27 11,840 --------- C:\WINDOWS\system32\tvsehkbc.dll
2007-09-25 15:09 <DIR> d-------- C:\VundoFix Backups
2007-09-25 12:40 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-09-25 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-25 10:16 11,840 --a------ C:\WINDOWS\system32\yfitlibn.dll
2007-09-24 10:18 11,840 --a------ C:\WINDOWS\system32\mmuiaild.dll
2007-09-23 10:15 11,840 --a------ C:\WINDOWS\system32\tljdqudu.dll
2007-09-16 10:32 <DIR> d-------- C:\Program Files\Common Files\Broderbund
2007-09-12 10:46 <DIR> d-------- C:\Program Files\Diino
2007-09-12 10:46 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\Diino
2007-09-08 20:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-09-08 13:30 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-09-08 13:30 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-08-29 09:49 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\Google
2007-08-20 13:55 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies
2007-08-20 12:24 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\vlc
2007-08-20 12:23 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\dvdcss
2007-08-17 23:05 <DIR> d-------- C:\Program Files\SHARP GSM GPRS USB Driver
2007-08-14 16:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-08-07 22:45 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Google
2007-08-07 22:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-30 11:00 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-09-26 22:32 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-25 18:01 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-25 17:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-09-20 04:01 --------- d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-18 21:52 --------- d-------- C:\Documents and Settings\Steve\Application Data\dvdcss
2007-09-16 10:34 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-30 10:43 --------- d-------- C:\Program Files\Picasa2
2007-08-29 10:52 --------- d-------- C:\Documents and Settings\Christine\Application Data\Canon
2007-08-29 09:49 --------- d-------- C:\Program Files\Google
2007-08-26 11:41 --------- d-------- C:\Program Files\EPSON Print CD
2007-08-20 13:55 --------- d-------- C:\Program Files\Sony Corporation
2007-08-06 23:32 12400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-08-04 13:59 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-07-30 22:27 --------- d-------- C:\Documents and Settings\Steve\Application Data\Canon
2007-07-29 14:11 --------- d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-06-13 23:23 1033216 --a------ C:\WINDOWS\explorer.exe
.

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B385AC8-B5AA-41A8-9199-4D5ED65359AE}]
C:\WINDOWS\system32\gebcb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4C11A13-DD98-45D3-9EBD-748B4379A395}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22]
"nwiz"="nwiz.exe" [2006-06-01 17:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll]
"EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [2005-03-09 17:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-06-09 21:31]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{79C29CCC-C25C-49CA-BD86-C3BE791F2E58}"= C:\WINDOWS\system32\khfcdca.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfcdca]
khfcdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Christine^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Christine\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DU Meter]
C:\Program Files\DU Meter\DUMeter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
%systemroot%\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"InCDsrv"=2 (0x2)
"gusvc"=2 (0x2)

R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys
R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys
R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys
R2 CoachCap;Concord EyeQ Duo LCD USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys
S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-30 11:18:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-30 11:20:56 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-30 11:20
.
--- E O F ---

Continued in next post...

Dantegirl
2007-09-30, 01:39
The new Hijackthis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:08 a.m., on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://wwp.greenwichmeantime.com/time-zone/north-america/canada/nova-scotia/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2B385AC8-B5AA-41A8-9199-4D5ED65359AE} - C:\WINDOWS\system32\gebcb.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {F4C11A13-DD98-45D3-9EBD-748B4379A395} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P30 "EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164000732946
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164058878906
O20 - Winlogon Notify: khfcdca - khfcdca.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6638 bytes

Thank you once again for your help, I look forward to your reply.
Dantegirl :bigthumb:

steamwiz
2007-09-30, 21:08
Hi

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the code box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)


File::
C:\WINDOWS\system32\ettybveh.dll
C:\WINDOWS\system32\albcyuoa.dll
C:\WINDOWS\system32\tpmfespk.dll
C:\WINDOWS\system32\kcrlsoyr.dll
C:\WINDOWS\system32\tvsehkbc.dll
C:\WINDOWS\system32\yfitlibn.dll
C:\WINDOWS\system32\mmuiaild.dll
C:\WINDOWS\system32\tljdqudu.dll

Folder::
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B385AC8-B5AA-41A8-9199-4D5ED65359AE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4C11A13-DD98-45D3-9EBD-748B4379A395}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{79C29CCC-C25C-49CA-BD86-C3BE791F2E58}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfcdca]



Save this as "CFScript.txt"

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

steam

Dantegirl
2007-09-30, 22:20
Hi Steam, here are the logs requested:

ComboFix 07-09-30.3 - Christine 2007-10-01 8:04:37.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.265 [GMT 13:00]
Running from: C:\Documents and Settings\Christine\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Christine\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\ettybveh.dll
C:\WINDOWS\system32\albcyuoa.dll
C:\WINDOWS\system32\tpmfespk.dll
C:\WINDOWS\system32\kcrlsoyr.dll
C:\WINDOWS\system32\tvsehkbc.dll
C:\WINDOWS\system32\yfitlibn.dll
C:\WINDOWS\system32\mmuiaild.dll
C:\WINDOWS\system32\tljdqudu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\bcbeg.bak1.bad
C:\VundoFix Backups\bcbeg.bak2.bad
C:\VundoFix Backups\bcbeg.ini.bad
C:\VundoFix Backups\bcbeg.ini2.bad
C:\VundoFix Backups\bcbeg.tmp.bad
C:\VundoFix Backups\ettybveh.dll.bad
C:\VundoFix Backups\evdkxsux.dll.bad
C:\VundoFix Backups\gebcb.dll.bad
C:\VundoFix Backups\ltvgbogx.dll.bad
C:\VundoFix Backups\tvsehkbc.dll.bad
C:\VundoFix Backups\udmxkqyc.dll.bad
C:\VundoFix Backups\xusxkdve.ini.bad
C:\WINDOWS\system32\albcyuoa.dll
C:\WINDOWS\system32\ettybveh.dll
C:\WINDOWS\system32\kcrlsoyr.dll
C:\WINDOWS\system32\mmuiaild.dll
C:\WINDOWS\system32\tljdqudu.dll
C:\WINDOWS\system32\tpmfespk.dll
C:\WINDOWS\system32\tvsehkbc.dll
C:\WINDOWS\system32\yfitlibn.dll

.
((((((((((((((((((((((((( Files Created from 2007-08-28 to 2007-09-30 )))))))))))))))))))))))))))))))
.

2007-09-30 11:01 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-28 16:24 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-25 17:58 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-09-25 17:58 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-09-25 17:58 <DIR> d-------- C:\Program Files\Symantec
2007-09-25 17:32 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-09-25 12:40 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-09-25 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-16 10:32 <DIR> d-------- C:\Program Files\Common Files\Broderbund
2007-09-12 10:46 <DIR> d-------- C:\Program Files\Diino
2007-09-12 10:46 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\Diino
2007-09-08 20:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-09-08 13:30 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-09-08 13:30 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2007-08-29 09:49 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\Google
2007-08-20 13:55 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies
2007-08-20 12:24 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\vlc
2007-08-20 12:23 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\dvdcss
2007-08-17 23:05 <DIR> d-------- C:\Program Files\SHARP GSM GPRS USB Driver
2007-08-14 16:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-08-07 22:45 <DIR> d-------- C:\Documents and Settings\Steve\Application Data\Google
2007-08-07 22:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-01 08:11 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-09-26 22:32 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-25 18:01 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-25 17:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-09-20 04:01 --------- d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-18 21:52 --------- d-------- C:\Documents and Settings\Steve\Application Data\dvdcss
2007-09-16 10:34 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-30 10:43 --------- d-------- C:\Program Files\Picasa2
2007-08-29 10:52 --------- d-------- C:\Documents and Settings\Christine\Application Data\Canon
2007-08-29 09:49 --------- d-------- C:\Program Files\Google
2007-08-26 11:41 --------- d-------- C:\Program Files\EPSON Print CD
2007-08-20 13:55 --------- d-------- C:\Program Files\Sony Corporation
2007-08-06 23:32 12400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-08-04 13:59 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-07-30 22:27 --------- d-------- C:\Documents and Settings\Steve\Application Data\Canon
2007-07-29 14:11 --------- d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-06-13 23:23 1033216 --a------ C:\WINDOWS\explorer.exe
.

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22]
"nwiz"="nwiz.exe" [2006-06-01 17:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll]
"EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [2005-03-09 17:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-06-09 21:31]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2004-07-07 20:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:56]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Christine^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Christine\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DU Meter]
C:\Program Files\DU Meter\DUMeter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
%systemroot%\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"InCDsrv"=2 (0x2)
"gusvc"=2 (0x2)

R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys
R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys
R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys
R2 CoachCap;Concord EyeQ Duo LCD USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys
S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-01 08:10:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-01 8:13:29 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-01 08:13
C:\ComboFix2.txt ... 2007-09-30 11:20
.
--- E O F ---



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:15:01 a.m., on 1/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://wwp.greenwichmeantime.com/time-zone/north-america/canada/nova-scotia/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R230 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /P30 "EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1164000732946
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164058878906
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6584 bytes

Ready for the next step...:)

steamwiz
2007-09-30, 23:09
HI



Ready for the next step...


Looks good :bigthumb: is your problem resolved ... it looks like it is ;)

steam

Dantegirl
2007-10-01, 00:43
Hi Steam,
Thank you for all your help. :D:
So far no pop ups and computer is running at the speed it should. Do I go ahead now and use it as normal or should I run another Spybot S & D? I must admit I am a little nervous about using it at all...any tips on how to avoid reinfection?
Thanks, Dantegirl :bigthumb:

steamwiz
2007-10-01, 01:02
Hi

Sure ... use it however you want to ... it's nearly as good as the day it came out of the box ...

RE-run any scans you want to, & if they show anything you are concerned about, come back & tell me.

Have a look here :-

So how did I get infected in the first place? for ways to protect yourself by TonyKlein :-

http://forums.spybot.info/showthread.php?t=279

steam

Dantegirl
2007-10-01, 01:53
Hi Steam
I re-ran Spybot S & D and it came up with a couple of tracking cookies (Doubleclick & Tradedoubler) and also Virtumonde.Generic (1 entry) in the registry. I "fixed" the problems, but this usually hasn't fixed virtumonde in the past. Any suggestions as to what to do next? or is this just a residual entry which is not going to cause any problems?

steamwiz
2007-10-01, 21:24
Hi

Picking up tracking cookies is a part of everyday surfing nowadays ... installing the MVPS hosts file & IESpyad (both mentioned in TonyKlein's article) will greatly reduce how many you get ... but some will always get through ...

As for the "Virtumonde.Generic (1 entry) in the registry" I expect it may well have just been a leftover ... registry keys without files are no threat ... but if spybot shows it again, then please post the spybot log showing the entry.

steam

Dantegirl
2007-10-01, 22:43
Hi Steam
I just ran another Spybot and Yayy! no immediate threats found. I will install the IE-Spyad and MVPS (I assume they can go hand in hand) but will read the tutorial on them first.
Thank you so much for all your help :bigthumb:
I have printed off the "So how did I get infected in the first place" Article and am following the instructions there to hopefully get a super protected computer :)
Thanks once again, I must admit it is great to know someone out there :angel: can look after computer users like me.
Have a great day,
Dantegirl :)

steamwiz
2007-10-01, 23:31
Hi

You're very welcome ... :)



I will install the IE-Spyad and MVPS (I assume they can go hand in hand)


Yes ... no problem ... they both do different things

Happy surfing

steam

Dantegirl
2007-10-02, 13:36
Hi Steam
You remember when I said I know enough about computers to be dangerous? Well :oops:
In the process of trying to build a super protected computer, I now have some fatal errors coming up, with a possible divorce pending!
The story so far...
I was trying to put the IE-Spyad thing onto my restricted sites zone, but it varies from what I understood of the tutorial, now going by zoned out, or something like that, and when it didn't seem to register the way it should, I did the worst thing I possibly could...:red: I used the system restore to go back to the last restore point which was created after I had changed the CFscript file in Combofix, and then :sad::red::sad::red: (cringe) reran Combofix. Since then I have received fatal error messages each time I restart, and my Symantec Antivirus has gone belly up. (it won't let me reinstall it...)
This probably isn't your area as it is not technically a virus, all scans so far showing clear, but if you could see your way to help me one last time, I have promised my husband and now I will promise you, I am not going to fiddle with the computer settings anymore and if I don't fully understand something, I will not FIDDLE!!!

In the hope you can see your way clear to help me once again, here is the combofix log of my muck up...

ComboFix 07-09-30.3 - Christine 2007-10-02 9:31:57.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254 [GMT 13:00]
Running from: C:\Documents and Settings\Christine\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-09-01 to 2007-10-01 )))))))))))))))))))))))))))))))
.

2007-10-02 09:15 <DIR> d-------- C:\VundoFix Backups
2007-09-30 11:01 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-29 22:03 11,840 --------- C:\WINDOWS\system32\ettybveh.dll
2007-09-28 22:03 11,840 --a------ C:\WINDOWS\system32\albcyuoa.dll
2007-09-28 16:24 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-27 22:04 11,840 --a------ C:\WINDOWS\system32\tpmfespk.dll
2007-09-26 21:59 11,840 --a------ C:\WINDOWS\system32\kcrlsoyr.dll
2007-09-25 17:58 83,168 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-09-25 17:58 82,832 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-09-25 17:58 <DIR> d-------- C:\Program Files\Symantec
2007-09-25 17:32 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-09-25 15:27 11,840 --------- C:\WINDOWS\system32\tvsehkbc.dll
2007-09-25 12:40 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-09-25 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-25 10:16 11,840 --a------ C:\WINDOWS\system32\yfitlibn.dll
2007-09-24 10:18 11,840 --a------ C:\WINDOWS\system32\mmuiaild.dll
2007-09-23 10:15 11,840 --a------ C:\WINDOWS\system32\tljdqudu.dll
2007-09-16 10:32 <DIR> d-------- C:\Program Files\Common Files\Broderbund
2007-09-12 10:46 <DIR> d-------- C:\Program Files\Diino
2007-09-12 10:46 <DIR> d-------- C:\Documents and Settings\Christine\Application Data\Diino
2007-09-08 20:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-09-08 20:54 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-09-08 13:30 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2007-09-08 13:30 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-02 09:14 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-09-26 22:32 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-25 18:01 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-09-25 17:57 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-09-22 17:12 --------- d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-09-20 04:01 --------- d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-09-18 21:52 --------- d-------- C:\Documents and Settings\Steve\Application Data\dvdcss
2007-09-16 10:34 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-30 10:43 --------- d-------- C:\Program Files\Picasa2
2007-08-29 14:20 --------- d-------- C:\Documents and Settings\Christine\Application Data\Google
2007-08-29 10:52 --------- d-------- C:\Documents and Settings\Christine\Application Data\Canon
2007-08-29 09:49 --------- d-------- C:\Program Files\Google
2007-08-26 11:41 --------- d-------- C:\Program Files\EPSON Print CD
2007-08-20 13:55 --------- d-------- C:\Program Files\Sony Corporation
2007-08-20 13:55 --------- d-------- C:\Program Files\Common Files\muvee Technologies
2007-08-20 12:25 --------- d-------- C:\Documents and Settings\Christine\Application Data\dvdcss
2007-08-20 12:24 --------- d-------- C:\Documents and Settings\Christine\Application Data\vlc
2007-08-17 23:05 --------- d-------- C:\Program Files\SHARP GSM GPRS USB Driver
2007-08-14 16:00 --------- d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-08-07 23:35 --------- d-------- C:\Documents and Settings\Steve\Application Data\Google
2007-08-06 23:32 12400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-08-04 13:59 --------- d-------- C:\Program Files\Common Files\AVSMedia
2007-07-30 20:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 20:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 20:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 20:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 20:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 20:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 20:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 20:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 20:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 20:18 33624 --a------ C:\WINDOWS\system32\wups.dll
.

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B385AC8-B5AA-41A8-9199-4D5ED65359AE}]
C:\WINDOWS\system32\gebcb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4C11A13-DD98-45D3-9EBD-748B4379A395}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22]
"nwiz"="nwiz.exe" [2006-06-01 17:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll]
"EPSON Stylus Photo R230 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.exe" [2005-03-09 17:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-06-09 21:31]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2004-07-07 20:29]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{79C29CCC-C25C-49CA-BD86-C3BE791F2E58}"= C:\WINDOWS\system32\khfcdca.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfcdca]
khfcdca.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Christine^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Christine\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DU Meter]
C:\Program Files\DU Meter\DUMeter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
%systemroot%\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"InCDsrv"=2 (0x2)
"gusvc"=2 (0x2)

R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys
R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys
R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys
R2 CoachCap;Concord EyeQ Duo LCD USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
R3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys
S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 09:35:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-02 9:36:50
C:\ComboFix-quarantined-files.txt ... 2007-10-02 09:36
C:\ComboFix2.txt ... 2007-10-01 08:13
C:\ComboFix3.txt ... 2007-09-30 11:20
.
--- E O F ---

and also another file created at the same time...



2007-09-23 10:15 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tljdqudu.dll.vir
2007-09-24 10:18 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mmuiaild.dll.vir
2007-09-25 10:16 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\yfitlibn.dll.vir
2007-09-25 11:16 487 --a------ C:\Qoobox\Quarantine\C\WINDOWS\cookies.ini.vir
2007-09-25 15:14 850135 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\bcbeg.tmp.bad.vir
2007-09-25 15:20 90176 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\udmxkqyc.dll.bad.vir
2007-09-25 15:27 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tvsehkbc.dll.vir
2007-09-25 15:29 90176 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\evdkxsux.dll.vir
2007-09-25 15:42 842716 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\bcbeg.bak1.bad.vir
2007-09-25 15:42 90176 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\evdkxsux.dll.bad.vir
2007-09-25 15:43 11840 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\tvsehkbc.dll.bad.vir
2007-09-25 15:43 294 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\xusxkdve.ini.bad.vir
2007-09-26 21:59 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kcrlsoyr.dll.vir
2007-09-26 22:05 90176 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\shcmykhg.dll.vir
2007-09-26 23:40 294 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ghkymchs.ini.vir
2007-09-27 20:18 850730 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\bcbeg.ini2.bad.vir
2007-09-27 21:59 90176 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mgauadjd.dll.vir
2007-09-27 22:04 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tpmfespk.dll.vir
2007-09-28 16:34 474 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\djdauagm.ini.vir
2007-09-28 22:03 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\albcyuoa.dll.vir
2007-09-29 22:03 11840 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ettybveh.dll.vir
2007-09-29 22:09 90176 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ltvgbogx.dll.vir
2007-09-30 04:10 714 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xgobgvtl.ini.vir
2007-09-30 10:04 11840 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\ettybveh.dll.bad.vir
2007-09-30 10:04 869344 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\bcbeg.bak2.bad.vir
2007-09-30 10:04 90176 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\ltvgbogx.dll.bad.vir
2007-09-30 10:44 297524 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\gebcb.dll.bad.vir
2007-09-30 10:44 867179 --a------ C:\Qoobox\Quarantine\C\VundoFix Backups\bcbeg.ini.bad.vir


Folder PATH listing
Volume serial number is 6C86-4465
C:\QOOBOX\QUARANTINE
+---C
| +---VundoFix Backups
| | bcbeg.bak1.bad.vir
| | bcbeg.bak2.bad.vir
| | bcbeg.ini.bad.vir
| | bcbeg.ini2.bad.vir
| | bcbeg.tmp.bad.vir
| | ettybveh.dll.bad.vir
| | evdkxsux.dll.bad.vir
| | gebcb.dll.bad.vir
| | ltvgbogx.dll.bad.vir
| | tvsehkbc.dll.bad.vir
| | udmxkqyc.dll.bad.vir
| | xusxkdve.ini.bad.vir
| |
| \---WINDOWS
| | cookies.ini.vir
| |
| \---system32
| albcyuoa.dll.vir
| djdauagm.ini.vir
| ettybveh.dll.vir
| evdkxsux.dll.vir
| ghkymchs.ini.vir
| kcrlsoyr.dll.vir
| ltvgbogx.dll.vir
| mgauadjd.dll.vir
| mmuiaild.dll.vir
| shcmykhg.dll.vir
| tljdqudu.dll.vir
| tpmfespk.dll.vir
| tvsehkbc.dll.vir
| xgobgvtl.ini.vir
| yfitlibn.dll.vir
|
\---Registry_backups


:oops::oops::oops:
Hoping for your help once again,
Dantegirl

Dantegirl
2007-10-02, 22:28
Hi Steam
Just a quick note to say System Mechanic seemed to fix my fatal error problem, and I have now been able to reload Symantec. I guess I have been taught a lesson in not dabbling in things I don't understand...No more Fiddling with system things or fixes! :red:
Thank you for your help,
sheepishly yours
Dantegirl :red:

steamwiz
2007-10-02, 23:08
HI

IE-Spyad has to be installed using a program called ZonedOut ... that's all ...

I'm including my "foolproof" instructions at the bottom of this post ...

-
Can you use system restore to "undo" the restore you made ?

if you can't, then go back to post #5 in this thread & re-do the CFScript.txt

You have exactly the same malware showing again, so it will remove it again...

-
All Norton products don't like system restore ... you can't reinstall without uninstalling first, & you can't uninstall either because Norton is now corrupted... you have to completely remove Norton before you can reinstall it...

There is a program here which will do this :-

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039?Open&src=&docid=2004093015165236&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl=

Once you've run this you should be able to reinstall Norton...

At this stage I am going to assume that the fatal error messagesare being caused by Norton\Symantec Antivirus

let me know how you get on ...

steam

---
Installing IE-SPYAD using ZonedOut ...

First go to your root drive & create a new folder....

start > my computer > c:\ ... right click > new > folder > call it IE-SPYAD


1. Download and install ZonedOut from here ...

http://www.funkytoad.com/content/view/15/33/

To do this, click the above link ... then when you get to the ZonedOut page ...

Click the big Z

click save ... then use the drop down list to navigate to > C: > IE-SPYAD (the folder you created)

Click save ... the ZonedOut.zip file is then saved to the C:\IE-SPYAD folder ...

Right click the ZonedOut.zip file & extract here .. or (extract all... & extract to C:\IE-SPYAD)

you will then have ZonedOut folder with the zip file ...


Then to download IE-SPYAD click here :-

http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD_ZO

Scroll down to :-

Download:

IE-SPYAD for ZonedOut

IE-SPYAD_ZO.EXE 309 KB PGP signature
IE-SPYAD_ZO.ZIP 241 KB PGP signature

Download to :- C:\IE-SPYAD

Unpack the files in IE-SPYAD_ZO.ZIP or IE-SPYAD_ZO.EXE to C:\IE-SPYAD\ZonedOut

Now when you open the C:\IE-SPYAD\ZonedOut folder, you should have a total of 8 files & 1 folder (Adult)


If you have a previous version of IE-SPYAD installed - you must uninstall it before installing the new one...

this applies to any one of the "original" IE-SPYAD Restricted sites lists.

In which case read the writing in BLUE ... if you are installing IE-SPYAD for the first time - skip the BLUE writing.

Known Issue (all versions) -If you have by chance "immunized" your computer with Spybot Search and Destroy, and use

ZonedOut to "Remove All" restricted sites - ZonedOut will remove your trusted sites as well. Note that if you remove Spybot

Search and Destroys Immunization the problem goes away...

So ... if you have entries in the trusted sites which you don't want removed & you use Spybot S&D Immunization ... do this

first ... run spybot > click immunize > click undo .. you can re-immunize once you have IE-SPYAD installed ...

To uninstall a previous version of IE-SPYAD, > start the ZonedOut program. > [b]double click the ZonedOut.exe

click > Menu > Remove Sites > Remove All

ZonedOut will remove ALL sites from your Restricted sites zone in Internet Explorer.


NOW to Install the new IE-SPYAD for ZonedOut list ...

Leave the "Current Key" combo box (top right corner of ZonedOut) as "Current User"

click > Menu > Import/Export Sites > Import from File >

ZonedOut will open an "Open File" dialog box

You should see the IE-ADS.TXT in the box ...

click to highlight IE-ADS.TXT & click open

Click OK to the confirm box

Then please wait ... it will take several minutes

when it has finished a box will pop up "failure warnings" ... which should say There were no failures

Click close & then close ZonedOut

you are now protected from approx 30,000 dubious sites

steam

EDIT ... sorry... didn't see your last post ... if you still have any problems please let me know ...