Virtumonde will not go away: IE and firefox popups

[Blargbot]

I was merely trying to patch a game I had and suddenly was attacked my spyware, malware and I'm sure Viri and trojans... Now I am constantly battling these malicious applications, but they keep coming back. I try to run S&D in safe mode, but virtumonde continues to pop up... In normal operating mode, I am getting popups, popunders and registry key changes over and over...

Loathe I am to not have installed spybot first thing upon install (This is a new PC):

Logs:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, March 19, 2008 3:18:20 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/03/2008
Kaspersky Anti-Virus database records: 640648
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 38024
Number of viruses found: 16
Number of infected objects: 33
Number of suspicious objects: 0
Duration of the scan process: 00:16:31

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mіcrosoft\ѕрool32.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\akswyrib.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008031920080320\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\!update.exe Infected: Trojan-Downloader.Win32.PurityScan.fk skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\Perflib_Perfdata_1260.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\yazzsnet.exe/data0003 Infected: Trojan.Win32.Scapur.k skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\yazzsnet.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CL6B89EN\install_en[1].exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Normal\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Normal\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Online Services\rotehot89104.dll Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\Program Files\ΑppPatch\winlogon.exe Infected: Trojan-Downloader.Win32.PurityScan.fj skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP25\A0003614.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP25\A0003615.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003627.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003630.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003635.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003636.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003637.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003638.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003638.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003639.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003709.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\usbohcii.sys Object is locked skipped
C:\WINDOWS\system32\e5\widcom12.exe Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\WINDOWS\system32\gebaaaa.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\geede.dll_old Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\iDlo01\iDlo011065.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
C:\WINDOWS\system32\ifz.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\pmnoppn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\usn7\opz89104.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\WINDOWS\system32\usn7\opz89104.exe NSIS: infected - 1 skipped
C:\WINDOWS\system32\vtstt.dll_old Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\vtuussp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\asappsrv.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\command.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003623.exe Infected: not-a-virus:FraudTool.Win32.MalwarePro.b skipped
E:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003626.exe/Search And Destroy.exe Infected: not-a-virus:FraudTool.Win32.MalwarePro.b skipped
E:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\A0003626.exe SetupFactory: infected - 1 skipped
E:\System Volume Information\_restore{629F4E7F-8FF3-4988-8AD2-1B72EA13E863}\RP26\change.log Object is locked skipped

Scan process completed.

***

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:18 PM, on 3/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DNA\btdna.exe
E:\Applications\Search and Destroy\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\PPPATC~1\winlogon.exe
E:\Utilities\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
E:\Applications\Tug Zip\TUGZip\TUGZip.exe
E:\Applications\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {3241C2CF-705D-51DA-5162-5F00CCC080CF} - C:\WINDOWS\system32\ifz.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {91223DE9-F8E6-4FFD-8889-BE6784C18696} - C:\WINDOWS\system32\pmnoppn.dll
O2 - BHO: (no name) - {95633D6E-767A-4CD7-A69A-28DAE6BE54AF} - C:\WINDOWS\system32\geede.dll (file missing)
O2 - BHO: (no name) - {DDF51B84-B58A-42AA-8108-8613133F201D} - C:\WINDOWS\system32\vtstt.dll (file missing)
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Applications\Search and Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Ooel] "C:\PROGRA~1\PPPATC~1\winlogon.exe" -vt yazb
O4 - Global Startup: Logitech SetPoint.lnk = E:\Utilities\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2872F54-B817-4148-90AD-54C88841B729}: NameServer = 65.24.7.10,65.24.7.11
O20 - Winlogon Notify: pmnoppn - C:\WINDOWS\SYSTEM32\pmnoppn.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4080 bytes

[ken545]

Hello Blargbot

Welcome to Safer Networking.

Please read Before YouPost (http://forums.spybot.info/showthread.php?t=288)
That said, All advice given by anyone volunteering here, is taken at own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

You have a real mess going on, a good variety of malware on your system, lets do this.


Do this first


Disable the TeaTimer, you can re enable it when were done if you wish

Run Spybot-S&D in Advanced Mode.
If it is not already set to do this Go to the Mode menu select "Advanced Mode"
On the left hand side, Click on Tools
Then click on the Resident Icon in the List
Uncheck "Resident TeaTimer" and OK any prompts.
Restart your computer. <-- Important





Run these in order please, I need to see the reports for each scan and a New HJT log after you run the last scan.


Download VundoFix (http://www.atribune.org/ccount/click.php?id=4 ) to your desktop

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.




Please download Malwarebytes' Anti-Malware from Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) or Here (http://www.besttechie.net/tools/mbam-setup.exe)

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a Hijackthis log.








Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) or Here (http://subs.geekstogo.com/ComboFix.exe) to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
Click on this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re enable the protection again afterwards before connecting to the net

2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.

IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.


I need to see the Vundofix log, the Malwarebytes log , the Combofix log and a New HJT log please. They most likely will not fit all in one reply so take as many replies as you need to post them all.

Ken:)

[Blargbot]

Thanks for the fast response, I appreciate all the help that you provide to the public :D

VundoFix log (this actually yielded no return):

VundoFix V7.0.3

Scan started at 10:07:31 PM 3/19/2008

Listing files found while scanning....

No infected files were found.

Beginning removal...

****

Malwarebytes' Anti-Malware Log:

Malwarebytes' Anti-Malware 1.09
Database version: 508

Scan type: Quick Scan
Objects scanned: 29367
Time elapsed: 1 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 14
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{3241c2cf-705d-51da-5162-5f00ccc080cf} (Adware.ClickSpring) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3241c2cf-705d-51da-5162-5f00ccc080cf} (Adware.ClickSpring) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temp\NI.UGA6P_0001_N122M2802 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iDlo01 (Trojan.Downloader) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Administrator\Local Settings\Temp\outerinfo.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ifz.dll (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temp\NI.UGA6P_0001_N122M2802\settings.ini (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\core.cache.dsk (Malware.Trace) -> Delete on reboot.


----> I got an error while running MalwareByte that core.cache.dsk could not be removed and would be removed upon reboot. My PC reboot and MalwareByte did NOT run again, I wanted to follow instructions as closely as possible, so I didn't rerun it.

[Blargbot]

ComboFix log:

ComboFix 08-03-18.1 - Administrator 2008-03-19 22:19:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1674 [GMT -5:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\MCROSO~1
C:\Documents and Settings\Administrator\Application Data\MCROSO~1\??ool32.exe
C:\Program Files\Online Services\rotehot89104.dll
C:\Program Files\pppatc~1
C:\Program Files\pppatc~1\?ppPatch\
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\sanR24
C:\Temp\sanR24\lDii.log
C:\temp\tn3
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\cfhkj.ini2
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\usbohcii.sys
C:\WINDOWS\system32\e5
C:\WINDOWS\system32\edeeg.ini
C:\WINDOWS\system32\edeeg.ini2
C:\WINDOWS\system32\ttstv.ini
C:\WINDOWS\system32\ttstv.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR
-------\Legacy_USBOHCII
-------\Service_usbohcii


((((((((((((((((((((((((( Files Created from 2008-02-20 to 2008-03-20 )))))))))))))))))))))))))))))))
.

2008-03-19 22:12 . 2008-03-19 22:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-19 22:12 . 2008-03-19 22:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-03-19 22:11 . 2008-03-19 22:11 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-03-19 22:07 . 2008-03-19 22:07 <DIR> d-------- C:\VundoFix Backups
2008-03-19 18:24 . 2008-03-19 18:24 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-19 18:24 . 2008-03-19 18:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-19 18:24 . 2008-03-19 18:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-19 18:24 . 2008-03-19 18:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-19 18:24 . 2008-03-19 18:24 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-03-19 16:12 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-03-19 16:12 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-03-19 16:12 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-19 16:12 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-03-19 16:12 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-19 16:01 . 2008-03-19 18:15 414 --ahs---- C:\WINDOWS\system32\myiessce.ini
2008-03-19 13:57 . 2008-03-19 13:57 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-19 13:57 . 2008-03-19 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-19 13:34 . 2008-03-19 13:34 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-19 11:56 . 2008-03-19 14:25 294 --ahs---- C:\WINDOWS\system32\eavlhtiv.ini
2008-03-18 23:08 . 2008-03-19 19:12 1,479 --a------ C:\WINDOWS\wininit.ini
2008-03-18 22:49 . 2008-03-19 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d--hs---- C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\usn7
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\ras3
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\npd2
2008-03-18 22:35 . 2008-03-19 22:19 <DIR> d-------- C:\Temp
2008-03-17 18:43 . 2008-03-17 18:43 <DIR> d-------- C:\Program Files\DNA
2008-03-17 18:43 . 2008-03-19 22:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DNA
2008-03-17 18:43 . 2008-03-19 22:06 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\BitTorrent
2008-03-17 17:35 . 2008-03-17 17:35 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-03-17 17:35 . 2008-03-17 17:35 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-03-17 17:34 . 2008-03-17 17:34 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-03-17 17:34 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-03-17 17:34 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-03-17 17:34 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-03-17 17:34 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-03-17 17:31 . 2003-08-29 23:51 156,160 --a------ C:\WINDOWS\system32\unrar3.dll
2008-03-17 17:31 . 2003-08-29 23:52 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\QuickTime
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\iPod
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\Bonjour
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-16 22:40 . 2008-03-17 18:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-16 22:40 . 2008-03-16 22:40 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Program Files\Apple Software Update
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-03-16 21:52 . 2008-03-16 21:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SecondLife
2008-03-16 19:26 . 2008-03-16 19:43 <DIR> d-------- C:\WINDOWS\NV3912224.TMP
2008-03-16 19:26 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-03-16 12:55 . 2008-03-16 12:55 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-03-16 04:05 . 2008-03-16 04:05 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-15 22:24 . 2005-10-27 02:06 356,096 -ra------ C:\WINDOWS\system32\drivers\rt61.sys
2008-03-15 20:19 . 2008-03-15 20:19 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-03-15 19:32 . 2008-03-15 19:32 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-15 07:11 . 2005-11-23 15:51 245,248 -ra------ C:\WINDOWS\system32\drivers\rt73.sys
2008-03-14 09:45 . 2008-03-14 09:45 <DIR> d-------- C:\Program Files\Ubi Soft
2008-03-14 09:45 . 2000-05-22 03:00 140,488 -ra------ C:\WINDOWS\system32\comdlg32.ocx
2008-03-14 09:45 . 1998-06-24 03:00 115,016 -ra------ C:\WINDOWS\system32\MSINET.OCX
2008-03-14 09:45 . 1998-06-18 03:00 89,360 -ra------ C:\WINDOWS\system32\VB5DB.DLL
2008-03-14 09:45 . 2000-03-17 11:21 69,632 -ra------ C:\WINDOWS\system32\xmltok.dll
2008-03-14 09:45 . 2000-03-17 11:21 36,864 -ra------ C:\WINDOWS\system32\xmlparse.dll
2008-03-14 09:45 . 2002-04-24 15:43 35,840 -ra------ C:\WINDOWS\system32\comdlg32.oca
2008-03-14 09:45 . 2002-04-09 20:23 29,184 -ra------ C:\WINDOWS\system32\MSINET.oca
2008-03-14 09:45 . 2002-06-17 10:25 26,088 -ra------ C:\WINDOWS\system32\xmlinst.exe
2008-03-14 09:45 . 2002-01-07 19:30 24,576 -ra------ C:\WINDOWS\system32\msxml3a.dll
2008-03-14 09:42 . 2008-03-14 09:42 0 --a------ C:\WINDOWS\PowerReg.dat
2008-03-12 06:09 . 2008-03-12 06:09 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-03-12 06:09 . 2008-03-12 06:09 18,676 --a------ C:\WINDOWS\War3Unin.dat
2008-03-12 06:09 . 2008-03-12 06:09 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-03-12 05:02 . 2008-03-12 05:02 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-03-11 22:41 . 2008-03-11 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-03-11 10:20 . 2008-03-11 10:20 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-08 06:14 . 2008-03-08 06:14 9,216 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-08 06:14 . 2008-03-08 06:14 7,680 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-07 02:29 . 2008-03-07 03:39 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2008-03-07 02:29 . 2008-03-07 03:39 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2008-03-07 02:29 . 2008-03-07 03:39 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2008-03-07 02:26 . 2008-03-07 02:26 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-03-07 01:48 . 2008-03-07 01:48 <DIR> d-------- C:\Program Files\Mplayer
2008-03-07 01:45 . 1999-10-09 17:30 305,152 --a------ C:\WINDOWS\IsUninst.exe
2008-03-07 01:45 . 2008-03-07 01:56 817 --a------ C:\WINDOWS\QIII.INI
2008-03-07 00:40 . 2005-11-16 00:42 45,056 --a------ C:\WINDOWS\system32\drivers\iviVD.sys
2008-03-07 00:38 . 2008-03-07 00:38 33,860 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-03-07 00:25 . 2008-03-07 00:25 <DIR> d-------- C:\Program Files\InterVideo
2008-03-07 00:24 . 2008-03-07 00:24 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\InterVideo
2008-03-06 12:21 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-03-06 12:00 . 2008-03-06 12:02 <DIR> d-------- C:\Program Files\ASUS
2008-03-06 12:00 . 2004-02-27 00:00 962,612 --a------ C:\WINDOWS\system32\mfc42d.dll
2008-03-06 12:00 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-03-06 12:00 . 2006-01-10 03:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-03-06 12:00 . 2006-10-18 14:12 12,664 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-03-06 12:00 . 2006-10-19 03:11 12,096 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-03-06 12:00 . 2006-10-19 03:11 10,304 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-03-06 11:54 . 2008-03-06 11:54 <DIR> d-------- C:\Program Files\DIFX
2008-03-06 11:54 . 2006-06-18 23:37 36,864 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-03-06 11:23 . 2008-03-06 11:23 313 --a------ C:\WINDOWS\doom3.ini
2008-03-06 11:04 . 2008-03-06 11:04 <DIR> d-------- C:\Program Files\Common Files\LogiShared
2008-03-06 11:04 . 2008-03-06 11:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Logitech

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 22:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 08:53 347 ----a-w C:\Program Files\INSTALL.LOG
2008-03-07 05:26 65 ----a-w C:\Program Files\Common Files\appop.log
2008-03-06 16:59 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-06 16:23 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-03-06 14:09 --------- d-----w C:\Program Files\microsoft frontpage
2003-12-18 16:33 20,102 ----a-w C:\Program Files\Readme.txt
2003-09-03 12:46 10,960 ----a-w C:\Program Files\EULA.txt
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\asappsrv.dll
2005-08-02 21:58 293,888 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\command.exe
2005-07-29 21:24 472 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\oal5xApRK3IRtF1msqhCtqT.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0df26f05-49f0-46b6-8387-92c7c9064a9b}]
C:\WINDOWS\system32\eanwugne.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67F952EC-EC03-4CDE-A22D-0837D423E6DF}]
C:\WINDOWS\system32\jkhfc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95633D6E-767A-4CD7-A69A-28DAE6BE54AF}]
C:\WINDOWS\system32\geede.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DDF51B84-B58A-42AA-8108-8613133F201D}]
C:\WINDOWS\system32\vtstt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-03-17 18:43 287040]
"Ooel"="C:\PROGRA~1\PPPATC~1\winlogon.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12 729088]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 08:34 868352]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-19 18:24 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-19 18:24 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - E:\Utilities\Logitech\SetPoint\SetPoint.exe [2008-03-06 11:03:27 692224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnoppn]
pmnoppn.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Product Registration.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Product Registration.lnk
backup=C:\WINDOWS\pss\Product Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]
-ra------ 2006-11-14 01:25 363008 C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIRECTCD]
--a------ 2005-10-25 00:49 299008 C:\Program Files\InterVideo\Disc Master 2.5\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 13:10 267048 E:\Applications\Quicktime\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINCINEMAMGR]
--a------ 2006-06-06 06:53 303104 E:\Applications\Common\Bin\WinCinemaMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
C:\WINDOWS\system32\winsys2.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Ooel"="C:\PROGRA~1\PPPATC~1\winlogon.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Games\\Dawn Of War\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"E:\\Games\\Quake 3 Arena\\quake3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\Applications\\Quicktime\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"E:\\Applications\\Bit Torrent\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R0 ivicd;Ivi CDVD Filter Driver;C:\WINDOWS\system32\drivers\ivicd.sys [2005-01-12 06:29]
S3 iviudf;iviudf;C:\WINDOWS\system32\drivers\IviUdf.sys [2005-06-23 02:09]
S3 kbeepm;kbeepm;C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kbeepm.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f04d864e-eb5a-11dc-9ffc-806d6172696f}]
\Shell\AutoRun\command - D:\Setup\rsrc\Autorun.exe
\Shell\dinstall\command - D:\Directx\dxsetup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-17 03:39:55 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-19 22:20:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2008-03-19 22:21:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-20 03:21:01

[Blargbot]

HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:22:11 PM, on 3/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DNA\btdna.exe
E:\Utilities\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wscntfy.exe
E:\Applications\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: {b9a4609c-7c29-7838-6b64-0f9450f62fd0} - {0df26f05-49f0-46b6-8387-92c7c9064a9b} - C:\WINDOWS\system32\eanwugne.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67F952EC-EC03-4CDE-A22D-0837D423E6DF} - C:\WINDOWS\system32\jkhfc.dll (file missing)
O2 - BHO: (no name) - {95633D6E-767A-4CD7-A69A-28DAE6BE54AF} - C:\WINDOWS\system32\geede.dll (file missing)
O2 - BHO: (no name) - {DDF51B84-B58A-42AA-8108-8613133F201D} - C:\WINDOWS\system32\vtstt.dll (file missing)
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Ooel] "C:\PROGRA~1\PPPATC~1\winlogon.exe" -vt yazb
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = E:\Utilities\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205961073765
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2872F54-B817-4148-90AD-54C88841B729}: NameServer = 65.24.7.10,65.24.7.11
O20 - Winlogon Notify: pmnoppn - pmnoppn.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5271 bytes

[Blargbot]

Please note that I installed AVG after my initial post to try a AV application that might help with my unrelenting pop ups and problems (as an explanation to this now showing up in my HJT logs). Since AVG has purged some stuff, my PC has been running OK (still had popunders). Since running VF, MWB and CF, I haven't yet had a popunder... Thanks again :)

[ken545]

Good Morning,

Things are looking so much better. The slimeballs that write Vundo are forever changing file names so not to worry about Vundofix not finding any, Malwarebytes found a ton of them and removed them as did Combofix which removed C:\WINDOWS\system32\drivers\core.cache.dsk



You need to enable windows to show all files and folders, instructions Here (http://www.xtra.co.nz/help/0,,4155-1916458,00.html)


Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: {b9a4609c-7c29-7838-6b64-0f9450f62fd0} - {0df26f05-49f0-46b6-8387-92c7c9064a9b} - C:\WINDOWS\system32\eanwugne.dll (file missing)
O2 - BHO: (no name) - {67F952EC-EC03-4CDE-A22D-0837D423E6DF} - C:\WINDOWS\system32\jkhfc.dll (file missing)
O2 - BHO: (no name) - {95633D6E-767A-4CD7-A69A-28DAE6BE54AF} - C:\WINDOWS\system32\geede.dll (file missing)
O2 - BHO: (no name) - {DDF51B84-B58A-42AA-8108-8613133F201D} - C:\WINDOWS\system32\vtstt.dll (file missing)

O4 - HKCU\..\Run: [Ooel] "C:\PROGRA~1\PPPATC~1\winlogon.exe" -vt yazb

O20 - Winlogon Notify: pmnoppn - pmnoppn.dll (file missing)


Delete these files.
C:\WINDOWS\nsreg.dat
C:\WINDOWS\system32\eavlhtiv.ini




Download CCleaner from here (http://www.ccleaner.com/) to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced."
deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.


*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!
**Note** Go to Options> Cookies and any you want to keep move them to The Keep window



Post a new HJT log and lets make sure nothing has returned.

[Blargbot]

Ok, here is the remainder of the equation. I can see that what we requested to be removed has been removed. Let me know if you are still seeing problems.

Also to note, still no popups.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:07:11 PM, on 3/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\DNA\btdna.exe
E:\Utilities\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
E:\Applications\Search and Destroy\Spybot - Search & Destroy\TeaTimer.exe
E:\Applications\Bit Torrent\BitTorrent\bittorrent.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
E:\Applications\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {3241C2CF-705D-51DA-5162-5F00CCC080CF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {91223DE9-F8E6-4FFD-8889-BE6784C18696} - (no file)
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Applications\Search and Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Ooel] "C:\PROGRA~1\PPPATC~1\winlogon.exe" -vt yazb
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = E:\Utilities\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

E:\APPLIC~1\SEARCH~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205961073765
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) -

http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2872F54-B817-4148-90AD-54C88841B729}: NameServer = 65.24.7.10,65.24.7.11
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4730 bytes

[ken545]

Hello,

Before you post a HJT log, when it opens in Notepad, go to Format and make sure Wordwrap is unchecked.

Your TeaTimer is still enabled and will prevent the removal of some entries.

Download Reset Tea Timer (http://downloads.subratam.org/ResetTeaTimer.bat) to your desktop, you need to use Internet Explorer, double click it to run, just takes a sec.

REBOOT YOUR COMPUTER




Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Folder::



Folder::
C:\PROGRA~1\PPPATC~1

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ooel"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Ooel"=-


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.



Then do this.

Go to VirusTotal (http://www.virustotal.com/) and submit this file for analysis, just use the browse feature and then Send File , you will get a report back, post the report into this thread for me to see.

C:\WINDOWS\system32\winsys2.exe

[Blargbot]

Combofix log:
ComboFix 08-03-18.1 - Administrator 2008-03-20 21:51:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1655 [GMT -5:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\cfscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-19 22:12 . 2008-03-19 22:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-19 22:12 . 2008-03-19 22:12 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-03-19 22:11 . 2008-03-19 22:11 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-03-19 22:07 . 2008-03-19 22:07 <DIR> d-------- C:\VundoFix Backups
2008-03-19 18:24 . 2008-03-19 18:24 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-19 18:24 . 2008-03-19 18:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-19 18:24 . 2008-03-19 18:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-19 18:24 . 2008-03-19 18:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-19 18:24 . 2008-03-19 18:24 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-03-19 16:12 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-03-19 16:12 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-03-19 16:12 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-19 16:12 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-03-19 16:12 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-19 16:01 . 2008-03-19 18:15 414 --ahs---- C:\WINDOWS\system32\myiessce.ini
2008-03-19 13:57 . 2008-03-19 13:57 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-19 13:57 . 2008-03-19 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-18 23:08 . 2008-03-19 19:12 1,479 --a------ C:\WINDOWS\wininit.ini
2008-03-18 22:49 . 2008-03-19 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d--hs---- C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\usn7
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\ras3
2008-03-18 22:35 . 2008-03-18 22:35 <DIR> d-------- C:\WINDOWS\system32\npd2
2008-03-18 22:35 . 2008-03-19 22:19 <DIR> d-------- C:\Temp
2008-03-17 18:43 . 2008-03-17 18:43 <DIR> d-------- C:\Program Files\DNA
2008-03-17 18:43 . 2008-03-20 21:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DNA
2008-03-17 18:43 . 2008-03-20 21:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\BitTorrent
2008-03-17 17:35 . 2008-03-17 17:35 262,144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2008-03-17 17:35 . 2008-03-17 17:35 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2008-03-17 17:34 . 2008-03-17 17:34 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-03-17 17:34 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-03-17 17:34 . 1999-11-02 10:01 6,173 --a------ C:\WINDOWS\system32\drivers\Entech.vxd
2008-03-17 17:34 . 2004-06-22 15:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-03-17 17:34 . 2001-11-19 19:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-03-17 17:31 . 2003-08-29 23:51 156,160 --a------ C:\WINDOWS\system32\unrar3.dll
2008-03-17 17:31 . 2003-08-29 23:52 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\QuickTime
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\iPod
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Program Files\Bonjour
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-16 22:40 . 2008-03-16 22:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-16 22:40 . 2008-03-17 18:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-16 22:40 . 2008-03-16 22:40 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Program Files\Apple Software Update
2008-03-16 22:39 . 2008-03-16 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-03-16 21:52 . 2008-03-16 21:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SecondLife
2008-03-16 19:26 . 2008-03-16 19:43 <DIR> d-------- C:\WINDOWS\NV3912224.TMP
2008-03-16 19:26 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-03-16 12:55 . 2008-03-16 12:55 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-03-16 04:05 . 2008-03-16 04:05 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-15 22:24 . 2005-10-27 02:06 356,096 -ra------ C:\WINDOWS\system32\drivers\rt61.sys
2008-03-15 20:19 . 2008-03-15 20:19 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-03-15 19:32 . 2008-03-15 19:32 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-15 07:11 . 2005-11-23 15:51 245,248 -ra------ C:\WINDOWS\system32\drivers\rt73.sys
2008-03-14 09:45 . 2008-03-14 09:45 <DIR> d-------- C:\Program Files\Ubi Soft
2008-03-14 09:45 . 2000-05-22 03:00 140,488 -ra------ C:\WINDOWS\system32\comdlg32.ocx
2008-03-14 09:45 . 1998-06-24 03:00 115,016 -ra------ C:\WINDOWS\system32\MSINET.OCX
2008-03-14 09:45 . 1998-06-18 03:00 89,360 -ra------ C:\WINDOWS\system32\VB5DB.DLL
2008-03-14 09:45 . 2000-03-17 11:21 69,632 -ra------ C:\WINDOWS\system32\xmltok.dll
2008-03-14 09:45 . 2000-03-17 11:21 36,864 -ra------ C:\WINDOWS\system32\xmlparse.dll
2008-03-14 09:45 . 2002-04-24 15:43 35,840 -ra------ C:\WINDOWS\system32\comdlg32.oca
2008-03-14 09:45 . 2002-04-09 20:23 29,184 -ra------ C:\WINDOWS\system32\MSINET.oca
2008-03-14 09:45 . 2002-06-17 10:25 26,088 -ra------ C:\WINDOWS\system32\xmlinst.exe
2008-03-14 09:45 . 2002-01-07 19:30 24,576 -ra------ C:\WINDOWS\system32\msxml3a.dll
2008-03-14 09:42 . 2008-03-14 09:42 0 --a------ C:\WINDOWS\PowerReg.dat
2008-03-12 06:09 . 2008-03-12 06:09 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-03-12 06:09 . 2008-03-12 06:09 18,676 --a------ C:\WINDOWS\War3Unin.dat
2008-03-12 06:09 . 2008-03-12 06:09 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-03-12 05:02 . 2008-03-12 05:02 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-03-11 22:41 . 2008-03-11 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-03-11 10:20 . 2008-03-11 10:20 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-08 06:14 . 2008-03-08 06:14 9,216 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-08 06:14 . 2008-03-08 06:14 7,680 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-07 02:29 . 2008-03-07 03:39 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2008-03-07 02:29 . 2008-03-07 03:39 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2008-03-07 02:29 . 2008-03-07 03:39 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2008-03-07 02:26 . 2008-03-07 02:26 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-03-07 01:48 . 2008-03-07 01:48 <DIR> d-------- C:\Program Files\Mplayer
2008-03-07 01:45 . 1999-10-09 17:30 305,152 --a------ C:\WINDOWS\IsUninst.exe
2008-03-07 01:45 . 2008-03-07 01:56 817 --a------ C:\WINDOWS\QIII.INI
2008-03-07 00:40 . 2005-11-16 00:42 45,056 --a------ C:\WINDOWS\system32\drivers\iviVD.sys
2008-03-07 00:38 . 2008-03-07 00:38 33,860 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-03-07 00:25 . 2008-03-07 00:25 <DIR> d-------- C:\Program Files\InterVideo
2008-03-07 00:24 . 2008-03-07 00:24 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\InterVideo
2008-03-06 12:21 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe
2008-03-06 12:00 . 2008-03-06 12:02 <DIR> d-------- C:\Program Files\ASUS
2008-03-06 12:00 . 2004-02-27 00:00 962,612 --a------ C:\WINDOWS\system32\mfc42d.dll
2008-03-06 12:00 . 2004-02-17 00:00 434,252 --a------ C:\WINDOWS\system32\MSVCRTD.DLL
2008-03-06 12:00 . 2006-01-10 03:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll
2008-03-06 12:00 . 2006-10-18 14:12 12,664 -ra------ C:\WINDOWS\system32\drivers\AsIO.sys
2008-03-06 12:00 . 2006-10-19 03:11 12,096 --a------ C:\WINDOWS\system32\drivers\AsInsHelp64.sys
2008-03-06 12:00 . 2006-10-19 03:11 10,304 --a------ C:\WINDOWS\system32\drivers\AsInsHelp32.sys
2008-03-06 11:54 . 2008-03-06 11:54 <DIR> d-------- C:\Program Files\DIFX
2008-03-06 11:54 . 2006-06-18 23:37 36,864 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-03-06 11:23 . 2008-03-06 11:23 313 --a------ C:\WINDOWS\doom3.ini
2008-03-06 11:04 . 2008-03-06 11:04 <DIR> d-------- C:\Program Files\Common Files\LogiShared
2008-03-06 11:04 . 2008-03-06 11:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Logitech
2008-03-06 11:04 . 2008-03-06 11:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Leadertech
2008-03-06 11:03 . 2008-03-16 22:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 22:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-16 08:53 347 ----a-w C:\Program Files\INSTALL.LOG
2008-03-07 05:26 65 ----a-w C:\Program Files\Common Files\appop.log
2008-03-06 16:59 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-06 16:23 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-03-06 14:09 --------- d-----w C:\Program Files\microsoft frontpage
2003-12-18 16:33 20,102 ----a-w C:\Program Files\Readme.txt
2003-09-03 12:46 10,960 ----a-w C:\Program Files\EULA.txt
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\asappsrv.dll
2005-08-02 21:58 293,888 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\command.exe
2005-07-29 21:24 472 --sha-r C:\WINDOWS\U3RldmVuIGFuZCBSYWNoZWw\oal5xApRK3IRtF1msqhCtqT.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3241C2CF-705D-51DA-5162-5F00CCC080CF}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-03-17 18:43 287040]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12 729088]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 08:34 868352]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-19 18:24 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-19 18:24 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - E:\Utilities\Logitech\SetPoint\SetPoint.exe [2008-03-06 11:03:27 692224]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Product Registration.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Product Registration.lnk
backup=C:\WINDOWS\pss\Product Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]
-ra------ 2006-11-14 01:25 363008 C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIRECTCD]
--a------ 2005-10-25 00:49 299008 C:\Program Files\InterVideo\Disc Master 2.5\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 13:10 267048 E:\Applications\Quicktime\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINCINEMAMGR]
--a------ 2006-06-06 06:53 303104 E:\Applications\Common\Bin\WinCinemaMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
C:\WINDOWS\system32\winsys2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Games\\Dawn Of War\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"E:\\Games\\Quake 3 Arena\\quake3.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"E:\\Applications\\Quicktime\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"E:\\Applications\\Bit Torrent\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R0 ivicd;Ivi CDVD Filter Driver;C:\WINDOWS\system32\drivers\ivicd.sys [2005-01-12 06:29]
S3 iviudf;iviudf;C:\WINDOWS\system32\drivers\IviUdf.sys [2005-06-23 02:09]
S3 kbeepm;kbeepm;C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kbeepm.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f04d864e-eb5a-11dc-9ffc-806d6172696f}]
\Shell\AutoRun\command - D:\Setup\rsrc\Autorun.exe
\Shell\dinstall\command - D:\Directx\dxsetup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-20 18:09:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-20 21:52:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-20 21:52:30
ComboFix-quarantined-files.txt 2008-03-21 02:52:28
ComboFix2.txt 2008-03-20 03:21:04

****

Virustotal Log:

This file was not located in C:\WINDOWS\system32\
It was located in C:\WINDOWS\system32\reinstallbackups\0004\driverfiles

MD5: daee383586db76671c43a83c04e51283
Date: 03.20.2008 23:31:46 (CET) [<1D]
Results: 0/32
Permalink: analisis/a2755d7c670af8ba134515ef9f69fa44

File WinSys2.exe received on 03.20.2008 23:27:34 (CET)
Current status: finished
Result: 0/32 (0.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.3.20.2 2008.03.20 -
AntiVir 7.6.0.75 2008.03.20 -
Authentium 4.93.8 2008.03.20 -
Avast 4.7.1098.0 2008.03.20 -
AVG 7.5.0.516 2008.03.20 -
BitDefender 7.2 2008.03.20 -
CAT-QuickHeal 9.50 2008.03.20 -
ClamAV 0.92.1 2008.03.20 -
DrWeb 4.44.0.09170 2008.03.20 -
eSafe 7.0.15.0 2008.03.18 -
eTrust-Vet 31.3.5629 2008.03.20 -
Ewido 4.0 2008.03.20 -
FileAdvisor 1 2008.03.20 -
Fortinet 3.14.0.0 2008.03.20 -
F-Prot 4.4.2.54 2008.03.19 -
F-Secure 6.70.13260.0 2008.03.20 -
Ikarus T3.1.1.20 2008.03.20 -
Kaspersky 7.0.0.125 2008.03.20 -
McAfee 5256 2008.03.20 -
Microsoft 1.3301 2008.03.20 -
NOD32v2 2965 2008.03.20 -
Norman 5.80.02 2008.03.20 -
Panda 9.0.0.4 2008.03.20 -
Prevx1 V2 2008.03.20 -
Rising 20.36.32.00 2008.03.20 -
Sophos 4.27.0 2008.03.20 -
Sunbelt 3.0.978.0 2008.03.18 -
Symantec 10 2008.03.20 -
TheHacker 6.2.92.250 2008.03.19 -
VBA32 3.12.6.3 2008.03.17 -
VirusBuster 4.3.26:9 2008.03.20 -
Webwasher-Gateway 6.6.2 2008.03.20 -
Additional information
File size: 208896 bytes
MD5: daee383586db76671c43a83c04e51283
SHA1: fd2d42ae4d08c8c05fd3d83f23226ce5876f2094
PEiD: -

[Blargbot]

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:59:17 PM, on 3/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\DNA\btdna.exe
E:\Utilities\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
E:\Applications\Hijack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {3241C2CF-705D-51DA-5162-5F00CCC080CF} - (no file)
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = E:\Utilities\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205961073765
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2872F54-B817-4148-90AD-54C88841B729}: NameServer = 65.24.7.10,65.24.7.11
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4387 bytes

[ken545]

Good Morning,

It looks like that file could swing either way but its showing its ok. According to Combofix its located where I posted and maybe related to a driver file for one of your progams.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
C:\WINDOWS\system32\winsys2.exe


Go me a favor and check again but do this first. If its present than upload it aqain and post the report , lf its not than let me know.

You need to enable windows to show all files and folders, instructions Here (http://www.xtra.co.nz/help/0,,4155-1916458,00.html)


Fix this one with HJT

O2 - BHO: (no name) - {3241C2CF-705D-51DA-5162-5F00CCC080CF} - (no file)


Everything else looks fine :bigthumb: How is your system running now???

[Blargbot]

This is just strange because I've done a file search and visually searched through that folder and can't find this file there:

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
C:\WINDOWS\system32\winsys2.exe

I ran HJT and fixed this:

Fix this one with HJT

O2 - BHO: (no name) - {3241C2CF-705D-51DA-5162-5F00CCC080CF} - (no file)

I ran HJT again and it is gone.

My PC is running great. Aside from all these ugly icons sitting on my desktop :)

[ken545]

Not sure what your referring to as far as the ugly icons ?????



Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png


When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.





How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
TonyKlein CastleCops (http://www.castlecops.com/postlite7736-.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)



Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

Spybot Search and Destroy 1.5 (http://www.safer-networking.org/en/download/)
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.

Spyware Blaster (http://www.javacoolsoftware.com/spywareblaster.html) It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.

Spyware Guard (http://www.javacoolsoftware.com/spywareguard.html) It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.

IE-Spyad (http://www.pcworld.com/downloads/file/fid,23332-order,1-page,1-c,antispywaretools/description.html)
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

Firefox 2.0.0.12 (http://www.mozilla.org/products/firefox/) It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


Glad we could help

Safe Surfn
Ken

[Blargbot]

Sorry about the confusion :)

I was referring to all of the new icons I have sitting on my desktop because of my malware removal journey. I work at keeping my PC running in the best condition I can, from keeping my desktop clean of installers and shortcuts, to keeping it secure from outside interference. It was my mistake to not take the precautions before I was infected, but I appreciate your help in this.

Is there a way that I can contribute? I find this help useful for myself and think that it should continue to be available to others with the same problems :D

[ken545]

Good Morning,

Glad things are running better for you, this forum as most of all the other Malware Removal forums are run by volunteers and any donation big or small just helps keep us up and running. If you look up at the top of this page on the right there is a Donate link.

Or here
http://www.spybot.info/en/donate/index.html

Safe Surfn
Ken