PDA

View Full Version : Need help with Virtumonde...


Kalfas
2008-06-21, 21:35
Hi,
I have unsuccessfully tried to remove the Virtumnde from my computer. Spybot locates it again and again even if it had cleaned it last time, the pc is slower and certain websites won't load on firefox. I post both log from HJT and CombiFix.

Thanks

ComboFix 08-06-19.4 - Kalfas 2008-06-21 21:00:18.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1253.1.1033.18.590 [GMT 3:00]

Running from: I:\ComboFix.exe

* Resident AV is active





WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.



C:\WINDOWS\pskt.ini



.

((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))

.



2008-06-21 01:01 . 2008-06-21 20:05 534 ---hs---- C:\WINDOWS\system32\tvlemxpm.ini

2008-06-21 00:38 . 2008-06-21 00:38 13,312 --ahs---- C:\WINDOWS\Thumbs.db

2008-06-20 23:46 . 2008-06-21 00:18 <DIR> d-------- C:\VundoFix Backups

2008-06-20 22:23 . 2008-06-20 22:23 79,872 --a------ C:\WINDOWS\system32\mpxmelvt.dll

2008-06-20 22:20 . 2008-06-20 22:20 90,624 --a------ C:\WINDOWS\system32\fjdakgdw.dll

2008-06-20 16:21 . 2008-06-20 23:15 600 --a------ C:\WINDOWS\wininit.ini

2008-06-20 12:03 . 2008-06-20 12:02 691,545 --a------ C:\WINDOWS\unins000.exe

2008-06-20 12:03 . 2008-06-20 12:03 2,542 --a------ C:\WINDOWS\unins000.dat

2008-06-20 11:01 . 2008-06-20 11:01 0 --a------ C:\WINDOWS\BM2faf3b3a.xml

2008-06-19 23:19 . 2008-06-20 22:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-06-19 23:19 . 2008-06-20 22:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-06-19 23:03 . 2008-06-19 23:03 145 --a------ C:\WINDOWS\system32\winver.bat

2008-06-19 17:49 . 2008-06-20 00:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-06-19 17:49 . 2008-06-19 17:49 1,409 --a------ C:\WINDOWS\QTFont.for

2008-06-19 17:24 . 2008-06-19 17:24 <DIR> d-------- C:\Program Files\MagicISO

2008-06-18 14:46 . 2008-06-18 14:46 <DIR> d-------- C:\temp\schvideos

2008-06-17 18:25 . 2008-06-17 18:25 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2008-06-17 18:25 . 2008-06-17 18:25 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf

2008-06-17 18:19 . 2008-06-17 18:20 <DIR> d-------- C:\temp\Z610 back up

2008-06-16 20:24 . 2008-06-16 20:24 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll

2008-06-16 20:24 . 2008-06-16 20:24 21,672 --a------ C:\WINDOWS\system32\drivers\ggsemc.sys

2008-06-16 20:24 . 2008-06-16 20:24 13,352 --a------ C:\WINDOWS\system32\drivers\ggflt.sys

2008-06-16 20:23 . 2008-06-16 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson

2008-06-16 20:21 . 2008-06-16 20:21 <DIR> d-------- C:\Program Files\Sony Ericsson

2008-06-07 13:13 . 2008-06-07 13:13 <DIR> d-------- C:\Program Files\Wireless-G USB Network Adapter with RangeBooster

2008-06-04 20:55 . 2008-06-04 20:55 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ

2008-06-01 13:52 . 2008-06-01 13:52 <DIR> d-------- C:\WINDOWS\system32\scripting

2008-06-01 13:49 . 2008-06-01 13:49 <DIR> d-------- C:\WINDOWS\ServicePackFiles

2008-06-01 13:44 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\003191_.tmp

2008-06-01 10:55 . 2008-03-03 14:25 5,702 --ah----- C:\WINDOWS\nod32restoretemdono.reg

2008-06-01 10:55 . 2008-03-03 18:21 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg

2008-06-01 10:54 . 2008-06-01 10:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET



.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-21 17:03 0 ----a-w C:\WINDOWS\system32\drivers\lvuvc.hs

2008-06-21 17:00 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-06-21 09:29 --------- d-----w C:\Program Files\ESET

2008-06-19 20:14 --------- d-----w C:\Documents and Settings\Kalfas\Application Data\uTorrent

2008-06-16 10:27 --------- d-----w C:\Program Files\ChrisTV PVR

2008-06-14 12:16 --------- d-----w C:\Program Files\eMule

2008-06-08 15:05 --------- d-----w C:\Program Files\Last.fm

2008-06-07 10:13 20,747 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys

2008-06-07 10:13 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-28 20:54 --------- d-----w C:\Documents and Settings\Kalfas\Application Data\MyPhoneExplorer

2008-04-14 02:55 1,804 ----a-w C:\WINDOWS\system32\dcache.bin

2008-04-14 02:46 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe

2008-04-14 02:43 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll

2008-04-14 02:43 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll

2008-04-14 02:43 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll

2008-04-14 02:41 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll

2008-04-14 02:40 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll

2008-04-14 02:40 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll

2008-04-14 02:40 3,584 ----a-w C:\WINDOWS\system32\msafd.dll

2008-04-14 02:40 102,912 ----a-w C:\WINDOWS\system32\dpcdll.dll

2008-04-13 22:00 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys

2008-04-13 21:54 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe

2008-04-13 21:15 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys

2008-04-13 21:13 9,728 ----a-w C:\WINDOWS\system32\comsdupd.exe

2008-04-13 21:13 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe

2008-04-13 21:01 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll

2008-04-13 21:01 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe

2008-04-13 21:00 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll

2008-04-13 20:45 76,800 ----a-w C:\WINDOWS\system32\msshavmsg.dll

2008-04-13 20:09 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll

2008-04-13 20:09 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll

2008-04-13 20:09 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll

2008-04-13 20:07 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll

2008-04-13 20:07 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll

2008-04-13 19:57 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll

2008-04-13 19:56 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll

2008-04-13 19:56 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll

2008-04-13 19:56 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll

2008-04-13 19:54 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll

2008-04-13 19:51 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll

2008-04-13 19:39 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll

2008-04-13 19:33 63,488 ----a-w C:\WINDOWS\system32\browselc.dll

2008-04-13 19:33 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll

2008-04-13 19:18 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll

2008-04-13 19:15 216,064 ----a-w C:\WINDOWS\system32\moricons.dll

2008-04-13 18:56 56,832 ----a-w C:\WINDOWS\system32\mshtmler.dll

2008-04-13 18:53 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll

2008-04-13 18:52 48,128 ----a-w C:\WINDOWS\system32\inetres.dll

2008-04-13 18:09 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll

2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll

2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll

2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll

2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll

2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll

2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe

2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll

2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll

2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll

2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll

2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll

2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll

2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll

2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2003-03-21 10:37 16,056 ----a-w C:\Program Files\owcstp16.dll

2007-12-17 08:47 2,828 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

.


<pre>

----a-w 85,746,872 2006-11-08 15:53:40 C:\Programs\Music Production\Vst\Native.Instruments.FM8.VSTi.DXi.RTAS.1.01 .exe

</pre>





((((((((((((((((((((((((((((( snapshot@2008-06-21_ 1.01.06.39 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-06-20 21:56:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat

+ 2008-06-21 17:03:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat

+ 2008-06-21 09:27:26 10,134 ----a-r C:\WINDOWS\Installer\{7D974ACA-4EE5-412C-8E6A-A5B57B305727}\callmsi.exe

+ 2008-06-21 09:27:26 136,448 ----a-r C:\WINDOWS\Installer\{7D974ACA-4EE5-412C-8E6A-A5B57B305727}\egui.exe

+ 2008-02-20 08:01:30 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys

+ 2008-02-20 08:02:22 29,704 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys

+ 2008-02-20 08:11:16 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-12-26 01:39 5724184]

"RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe" [2003-06-12 09:47 135168]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTSysVol"="C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-07-02 10:03 57344]

"AsioReg"="REGSVR32.EXE" [2008-04-14 05:42 11776 C:\WINDOWS\system32\regsvr32.exe]

"SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06 45056]

"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]

"BluetoothAuthenticationAgent"="bthprops.cpl,,BluetoothAuthenticationAgent" []

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432]

"2c9c08a6"="C:\WINDOWS\system32\mpxmelvt.dll" [2008-06-20 22:23 79872]

"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072]

"BM2faf3b3a"="C:\WINDOWS\system32\fjdakgdw.dll" [2008-06-20 22:20 90624]



[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]



C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [8/20/2007 4:55:29 PM 450560]



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=WIKI.DLL



[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

"VIDC.ACDV"= ACDV.dll

"midi3"= KORGUMDD.DRV

"midi4"= KORGUMDD.DRV



[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup



[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickTV.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickTV.lnk

backup=C:\WINDOWS\pss\QuickTV.lnkCommon Startup



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2c9c08a6]

C:\WINDOWS\system32\osefqvwj.dll



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a------ 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM2faf3b3a]

C:\WINDOWS\system32\fqwyfawt.dll



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]

--a------ 2003-06-18 01:00 45056 C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]

--a------ 2003-06-20 06:55 24576 C:\WINDOWS\system32\CTHELPER.EXE



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]

--a------ 2005-10-23 01:00 385024 C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

--a------ 2005-08-11 17:30 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

--a------ 2005-08-11 17:30 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\WINDOWS\system32\dumprep 0 -k



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]

--a------ 2006-06-26 09:46 497200 C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

--a------ 2006-06-26 10:34 614960 C:\Program Files\Logitech\QuickCam10\QuickCam10.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX]

--a------ 2006-06-26 10:33 243248 C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSDisp32]

C:\WINDOWS\system32\drvmev.dll



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]

--------- 2005-04-08 18:43 1953792 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2007-06-29 00:43 8466432 C:\WINDOWS\system32\NvCpl.dll



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

--a------ 2007-06-29 00:43 81920 C:\WINDOWS\system32\NvMcTray.dll



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteCenter]



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScreenManager Pro for LCD]

--a------ 2004-03-22 05:31 794624 C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe



[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"usnjsvc"=3 (0x3)

"ose"=3 (0x3)

"LVSrvLauncher"=2 (0x2)

"LVPrcSrv"=2 (0x2)

"WUSB54GR"=2 (0x2)



[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\eMule\\emule.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

"C:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Railroads!\\RailRoads.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

"C:\\Program Files\\Railroad Tycoon II - TSC\\RT2_TSC.EXE"=

"C:\\WINDOWS\\system32\\dplaysvr.exe"=

"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=



R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]

R2 CX88XBAR;AVerMedia, AVerTV Crossbar (88x);C:\WINDOWS\system32\drivers\CX88XBAR.sys [2005-12-09 17:46]

R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 21:08]

R3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys [2005-06-17 13:48]

S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-06-16 20:24]

S3 KORGUMDS;KORG USB-MIDI Driver for Windows XP;C:\WINDOWS\system32\Drivers\KORGUMDS.SYS [2005-12-20 01:07]

S4 WUSB54GR;WUSB54GR;"C:\Program Files\Wireless-G USB Network Adapter with RangeBooster\WLService.exe" "WUSB54GR.exe" []



*Newly Created Service* - CATCHME

.

Contents of the 'Scheduled Tasks' folder

"2007-11-19 07:00:00 C:\WINDOWS\Tasks\ChrisTV PVR Professional.job"

- C:\PROGRA~1\CHRIST~1\ChrisTV.exe

.

**************************************************************************



catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-21 21:03:30

Windows 5.1.2600 Service Pack 3 NTFS



scanning hidden processes ...



scanning hidden autostart entries ...



scanning hidden files ...



scan completed successfully

hidden files: 0



**************************************************************************

.

Completion time: 2008-06-21 21:04:19

ComboFix-quarantined-files.txt 2008-06-21 18:04:16

ComboFix2.txt 2008-06-20 22:01:27



Pre-Run: 53,576,347,648 bytes free

Post-Run: 53,598,486,528 bytes free



262









Logfile of HijackThis v1.99.1

Scan saved at 9:21:16 μμ, on 21/6/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTSvcCDA.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

C:\WINDOWS\explorer.exe

C:\Program Files\HijackThis\HijackThis.exe



R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Βοηθός εισόδου του Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [2c9c08a6] rundll32.exe "C:\WINDOWS\system32\mpxmelvt.dll",b

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [BM2faf3b3a] Rundll32.exe "C:\WINDOWS\system32\fjdakgdw.dll",s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: žρευνα - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198366144779

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1198366130342

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C86CDE10-BD72-48B9-9C7C-3E7A8C4B1966}: NameServer = 193.92.150.3,194.219.227.1

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: WIKI.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Blade81
2008-06-23, 13:23
Do NOT run 'fixes' before helpers have analyzed HJT log (http://forums.spybot.info/showthread.php?t=16806) ;)


Delete following folders if you don't know what they are:
C:\temp\schvideos
C:\temp\Z610 back up

Disable word wrap from Notepad if it's on. It's easier read the logs if there're no empty gaps between the lines.


Open notepad and copy/paste the text in the quotebox below into it:



File::
C:\WINDOWS\system32\tvlemxpm.ini
C:\WINDOWS\system32\mpxmelvt.dll
C:\WINDOWS\system32\fjdakgdw.dll
C:\WINDOWS\BM2faf3b3a.xml
C:\WINDOWS\003191_.tmp
C:\WINDOWS\system32\drivers\lvuvc.hs

Folder::
C:\VundoFix Backups

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"2c9c08a6"=-
"BM2faf3b3a"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2c9c08a6]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM2faf3b3a]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

RENV::
C:\Programs\Music Production\Vst\Native.Instruments.FM8.VSTi.DXi.RTAS.1.01 .exe



Save this as
CFScript


http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.nl/scanforvirus-en/kavwebscan.html). You will be prompted to install an ActiveX component from Kaspersky, click Yes.
The program will launch and start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings and select the following:
Scan using the following Anti-Virus database:
Extended (If available, otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK.
Under
select a target to scan
, select My Computer.
The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.Once the scan is complete:
Click on the Save as Text button.
Save the file to your desktop.
Copy and paste that information into your next post if the AV content will fit into one post only. Post a fresh hjt log (without forgetting above meantioned ComboFix resultant log) too.


Note for Internet Explorer 7 users: If at any time you have trouble with the Accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

If having a problme doing the above

Make sure that your Internet security settings are set to default values.

To set default security settings for Internet Explorer:

* Open Internet Explorer.
* Go to the Tools menu, then choose Internet Options.
* Click on the Security tab.
* Make sure that all four item (Internet, Local intranet, Trusted sites, and Restricted sites) are set to their default settings.
Blade81
2008-06-29, 14:50
Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.