Virtumonde infection, help please!!

[The Frankman]

Hello

I have just noticed my computer slowing down and after I got a mesage saying my virus protection was turned off I ran a scan with Symantec (why I didn't change to AVG or Avast I don't know) and it found a Vundo and a Virtumonde.dll infection. I have tried to remove these myself via SpyBot and Symantec Vundofix program, which seemed to work until Virtumonde was discovered. I also ran Ad-Aware but the buggers keep coming back after a restart. I was just about to field-goal kick myself for not installing a less troublesome/more effective antivirus when I remembered I got help on this from months ago for some nasty things picked up on my sister's computer. As per all the rules and regulations here is my log.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:45 PM, on 6/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {05816D81-CB86-42CC-B72B-4FDA2DC562F2} - C:\WINDOWS\system32\efcASjkj.dll (file missing)
O2 - BHO: (no name) - {14027BA1-CA9A-444B-9902-4B28AC610B04} - C:\WINDOWS\system32\pmnmnOIA.dll (file missing)
O2 - BHO: (no name) - {522E0112-EDD9-413D-A99E-C311A54B6676} - C:\WINDOWS\system32\tuvTmmkK.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6BDB075A-83DF-424E-9D8A-69291A7FD648} - C:\Documents and Settings\Staind Blackheart\Local Settings\Temporary Internet Files\Content.IE5\GQT5IVOQ\3077ahntdksr[1].dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {86A41F8A-6EC4-4526-ABAD-1B2C03E053CD} - C:\WINDOWS\system32\iiffCVnn.dll
O2 - BHO: {0b3efcb5-ec96-de8a-5604-c4bb57ae617a} - {a716ea75-bb4c-4065-a8ed-69ce5bcfe3b0} - C:\WINDOWS\system32\ahnjnanh.dll
O2 - BHO: (no name) - {BC6CF7CB-F0BD-49F3-BC9B-7B3689472EB2} - C:\WINDOWS\system32\xkefbqcs.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [BMb3a0224d] Rundll32.exe "C:\WINDOWS\system32\msabgsvg.dll",s
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185486819562
O20 - Winlogon Notify: tuvTmmkK - C:\WINDOWS\SYSTEM32\tuvTmmkK.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: (no name) - http://duke.schnolis.com/gallery/main.php?g2_view=core.DownloadItem&g2_itemId=2794&g2_serialNumber=2

--
End of file - 6865 bytes

Also, my SpyBot report list 2 files in Windows/system32 and 4 registry keys (2 as brower helper objects) as infected with Virtumonde.

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

You are infected, I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
This can be a tough infection to remove so do not expect fast or easy.

Remove any old copies of combofix before you proceed.

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop

Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks

[The Frankman]

Okay, first my ComboFIx Log

ComboFix 08-06-20.4 - Staind Blackheart 2008-06-25 20:35:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.105 [GMT -4:00]
Running from: C:\Documents and Settings\Staind Blackheart\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMb3a0224d.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\AIOnmnmp.ini
C:\WINDOWS\system32\AIOnmnmp.ini2
C:\WINDOWS\system32\iiffCVnn.dll
C:\WINDOWS\system32\jkjSAcfe.ini
C:\WINDOWS\system32\jkjSAcfe.ini2
C:\WINDOWS\system32\knsntqkv.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnVCffii.ini
C:\WINDOWS\system32\nnVCffii.ini2
C:\WINDOWS\system32\tuvTmmkK.dll
C:\WINDOWS\system32\urqdbmot.ini
C:\WINDOWS\system32\xkefbqcs.dll
C:\WINDOWS\system32\ysdvidck.ini

.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.

2008-06-24 22:03 . 2008-06-24 22:03 99,840 --a------ C:\WINDOWS\system32\quvhklri.dll
2008-06-24 22:00 . 2008-06-24 22:00 81,920 --a------ C:\WINDOWS\system32\tombdqru.dll
2008-06-24 21:58 . 2008-06-24 21:58 91,136 --a------ C:\WINDOWS\system32\pbnljycj.dll
2008-06-24 21:03 . 2008-06-24 21:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-24 20:16 . 2008-06-24 20:16 81,920 --a------ C:\WINDOWS\system32\vkqtnsnk.dll
2008-06-24 20:13 . 2008-06-24 20:13 99,840 --a------ C:\WINDOWS\system32\ahnjnanh.dll
2008-06-24 20:11 . 2008-06-24 20:11 91,136 --a------ C:\WINDOWS\system32\msabgsvg.dll
2008-06-23 01:02 . 2008-06-23 01:02 <DIR> d-------- C:\Program Files\TagScanner
2008-06-22 14:40 . 2008-06-24 08:17 <DIR> d-------- C:\Program Files\PeerGuardian 2
2008-06-21 12:54 . 2008-06-21 12:54 331 --a------ C:\WINDOWS\doom3.ini
2008-06-21 12:41 . 2008-06-21 12:54 <DIR> d-------- C:\Program Files\Doom 3
2008-06-21 10:57 . 2008-06-21 10:57 <DIR> d-------- C:\Program Files\PowerISO
2008-06-16 21:49 . 2008-06-16 21:49 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-06-15 04:58 . 2008-06-15 04:58 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\ATI
2008-06-15 04:58 . 2008-06-15 04:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-06-15 04:57 . 2008-06-15 04:57 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-06-15 04:53 . 2008-06-15 04:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-06-15 04:53 . 2008-05-12 10:49 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-06-15 04:53 . 2008-04-01 22:17 106,496 --a------ C:\WINDOWS\system32\atinppt2.ax
2008-06-15 03:58 . 2008-06-15 03:58 <DIR> d-------- C:\Program Files\ImgBurn
2008-06-15 01:01 . 2008-06-15 01:01 <DIR> d-------- C:\Program Files\MAXIMUM
2008-06-15 01:01 . 2008-06-15 01:01 <DIR> d-------- C:\Program Files\MASTER
2008-06-15 00:43 . 2004-03-29 16:23 90,112 --a------ C:\WINDOWS\unvise32.exe
2008-06-15 00:42 . 2008-06-15 00:53 <DIR> d-------- C:\Program Files\YVD
2008-06-14 15:49 . 2008-06-14 15:49 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-06-14 15:48 . 2008-06-15 00:32 <DIR> d-------- C:\Program Files\Audacity
2008-06-14 04:49 . 2008-06-14 04:48 691,545 --a------ C:\WINDOWS\unins000.exe
2008-06-14 04:49 . 2008-06-14 04:49 2,557 --a------ C:\WINDOWS\unins000.dat
2008-06-14 04:35 . 2008-06-14 04:35 <DIR> d-------- C:\Program Files\Any Video Converter Professional
2008-06-14 04:35 . 2008-06-14 04:35 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Any Video Converter Professional
2008-06-14 04:35 . 2008-06-14 04:36 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-14 04:33 . 2008-06-14 04:34 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Any Video Converter
2008-06-13 02:40 . 2008-06-13 02:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\acccore
2008-06-13 02:14 . 2008-06-13 02:14 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Apple Computer
2008-06-13 02:11 . 2008-06-13 02:11 <DIR> d-------- C:\Program Files\K-Lite Mega Codec Pack 3.9.5
2008-06-13 00:08 . 2008-06-13 00:08 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-12 19:24 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 04:49 . 2008-06-12 04:49 <DIR> d-------- C:\Program Files\QuickTime
2008-06-12 04:48 . 2008-06-12 04:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-12 04:45 . 2008-06-12 04:45 <DIR> d-------- C:\Program Files\Apple Software Update
2008-06-12 04:45 . 2008-06-12 04:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-06-12 04:28 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-06-12 04:28 . 2004-08-03 23:10 61,056 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-06-12 04:28 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-06-12 04:28 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-06-12 04:28 . 2001-08-17 13:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-06-12 04:28 . 2001-08-17 13:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-06-12 04:27 . 2004-08-03 23:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2008-06-12 04:27 . 2004-08-03 23:08 10,624 --a--c--- C:\WINDOWS\system32\dllcache\gameenum.sys
2008-06-12 04:27 . 2001-08-17 14:00 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys
2008-06-12 04:27 . 2001-08-17 14:00 2,944 --a--c--- C:\WINDOWS\system32\dllcache\msmpu401.sys
2008-05-27 10:50 . 2008-05-27 10:50 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-05-27 10:50 . 2008-05-27 10:50 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-26 00:43 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-24 12:18 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\uTorrent
2008-06-21 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-21 16:37 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-18 07:10 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\dvdcss
2008-06-15 05:32 --------- d-----w C:\Program Files\WinASO
2008-06-15 05:04 --------- d-----w C:\Program Files\IrfanView
2008-06-14 19:05 --------- d-----w C:\Program Files\HP
2008-06-14 08:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 08:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 06:41 --------- d-----w C:\Program Files\AIM6
2008-06-13 06:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-13 06:04 --------- d-----w C:\Program Files\VideoLAN
2008-06-13 02:01 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\Yahoo!
2008-06-13 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-12 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-06-12 08:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-06-12 08:14 --------- d-----w C:\Program Files\Guild Wars
2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2007-07-29 02:56 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05816D81-CB86-42CC-B72B-4FDA2DC562F2}]
C:\WINDOWS\system32\efcASjkj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{14027BA1-CA9A-444B-9902-4B28AC610B04}]
C:\WINDOWS\system32\pmnmnOIA.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2fa3034d-3ad1-4a0c-9e26-2c86c7e41907}]
2008-06-24 22:03 99840 --a------ C:\WINDOWS\system32\quvhklri.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74315F6A-A462-4C57-96AE-AD90A1A8C04F}]
C:\Documents and Settings\Staind Blackheart\Local Settings\Temporary Internet Files\Content.IE5\1M8VJLLV\3077ahntdksr[1].dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-06-06 12:04 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33 125168]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 20:05 200704]
"b09311d1"="C:\WINDOWS\system32\tombdqru.dll" [2008-06-24 22:00 81920]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\YVD\\n00b-IRC.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-22 00:17:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 20:44:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\urqdbmot.ini 294 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\tombdqru.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2008-06-25 20:51:31 - machine was rebooted [Staind Blackheart]
ComboFix-quarantined-files.txt 2008-06-26 00:51:23

Pre-Run: 58,654,339,072 bytes free
Post-Run: 58,568,904,704 bytes free

187 --- E O F --- 2008-06-21 14:59:53

[The Frankman]

Now my HiJack This log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:01:30 PM, on 6/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {05816D81-CB86-42CC-B72B-4FDA2DC562F2} - C:\WINDOWS\system32\efcASjkj.dll (file missing)
O2 - BHO: (no name) - {14027BA1-CA9A-444B-9902-4B28AC610B04} - C:\WINDOWS\system32\pmnmnOIA.dll (file missing)
O2 - BHO: {70914e7c-68c2-62e9-c0a4-1da3d4303af2} - {2fa3034d-3ad1-4a0c-9e26-2c86c7e41907} - C:\WINDOWS\system32\quvhklri.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {74315F6A-A462-4C57-96AE-AD90A1A8C04F} - C:\Documents and Settings\Staind Blackheart\Local Settings\Temporary Internet Files\Content.IE5\1M8VJLLV\3077ahntdksr[1].dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [b09311d1] rundll32.exe "C:\WINDOWS\system32\tombdqru.dll",b
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185486819562
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: (no name) - http://duke.schnolis.com/gallery/main.php?g2_view=core.DownloadItem&g2_itemId=2794&g2_serialNumber=2

--
End of file - 6625 bytes

[pskelley]

Thanks for returning your information. Read and follow the directions carefully and in the numbered order.

1) C:\Program Files\Viewpoint\Common\ViewpointService.exe
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.greatis.com/appdata/u/v/viewmgr.exe.htm
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546

2) C:\Program Files\Java\jre1.6.0_03\ <<< Update your Java program, see this information:
http://forums.spybot.info/showpost.php?p=12880&postcount=2

3) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm. Click OK.
You may reverse this for safety when we are finished.

4) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

(follow the CFScript directions very carefully)

5) Open notepad and copy/paste the text in the codebox below into it:


File::
C:\WINDOWS\system32\quvhklri.dll
C:\WINDOWS\system32\tombdqru.dll
C:\WINDOWS\system32\pbnljycj.dll
C:\WINDOWS\system32\vkqtnsnk.dll
C:\WINDOWS\system32\ahnjnanh.dll
C:\WINDOWS\system32\msabgsvg.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05816D81-CB86-42CC-B72B-4FDA2DC562F2}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{14027BA1-CA9A-444B-9902-4B28AC610B04}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2fa3034d-3ad1-4a0c-9e26-2c86c7e41907}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74315F6A-A462-4C57-96AE-AD90A1A8C04F}]

Save this as CFScript

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(some items may have been removed by CFScript)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {05816D81-CB86-42CC-B72B-4FDA2DC562F2} - C:\WINDOWS\system32\efcASjkj.dll (file missing)
O2 - BHO: (no name) - {14027BA1-CA9A-444B-9902-4B28AC610B04} - C:\WINDOWS\system32\pmnmnOIA.dll (file missing)
O2 - BHO: {70914e7c-68c2-62e9-c0a4-1da3d4303af2} - {2fa3034d-3ad1-4a0c-9e26-2c86c7e41907} - C:\WINDOWS\system32\quvhklri.dll
O2 - BHO: (no name) - {74315F6A-A462-4C57-96AE-AD90A1A8C04F} - C:\Documents and Settings\Staind Blackheart\Local Settings\Temporary Internet Files\Content.IE5\1M8VJLLV\3077ahntdksr[1].dll (file missing)
O4 - HKLM\..\Run: [b09311d1] rundll32.exe "C:\WINDOWS\system32\tombdqru.dll",b

Close all programs but HJT and all browser windows, then click on "Fix Checked"

7) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart and post the combofix log from CFScript, a new HJT log and some feedback from you. How is the computer running now?

Thanks

[The Frankman]

My ComboFix Log

ComboFix 08-06-20.4 - Staind Blackheart 2008-06-25 22:08:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.220 [GMT -4:00]
Running from: C:\Documents and Settings\Staind Blackheart\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Staind Blackheart\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\ahnjnanh.dll
C:\WINDOWS\system32\msabgsvg.dll
C:\WINDOWS\system32\pbnljycj.dll
C:\WINDOWS\system32\quvhklri.dll
C:\WINDOWS\system32\tombdqru.dll
C:\WINDOWS\system32\vkqtnsnk.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ahnjnanh.dll
C:\WINDOWS\system32\msabgsvg.dll
C:\WINDOWS\system32\pbnljycj.dll
C:\WINDOWS\system32\quvhklri.dll
C:\WINDOWS\system32\tombdqru.dll
C:\WINDOWS\system32\urqdbmot.ini
C:\WINDOWS\system32\vkqtnsnk.dll

.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.

2008-06-25 21:59 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-25 21:58 . 2008-06-25 21:58 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-24 21:03 . 2008-06-24 21:03 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-23 01:02 . 2008-06-23 01:02 <DIR> d-------- C:\Program Files\TagScanner
2008-06-22 14:40 . 2008-06-24 08:17 <DIR> d-------- C:\Program Files\PeerGuardian 2
2008-06-21 12:54 . 2008-06-21 12:54 331 --a------ C:\WINDOWS\doom3.ini
2008-06-21 12:41 . 2008-06-21 12:54 <DIR> d-------- C:\Program Files\Doom 3
2008-06-21 10:57 . 2008-06-21 10:57 <DIR> d-------- C:\Program Files\PowerISO
2008-06-16 21:49 . 2008-06-16 21:49 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-06-15 04:58 . 2008-06-15 04:58 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\ATI
2008-06-15 04:58 . 2008-06-15 04:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-06-15 04:57 . 2008-06-15 04:57 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-06-15 04:53 . 2008-06-15 04:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-06-15 04:53 . 2008-05-12 10:49 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-06-15 04:53 . 2008-04-01 22:17 106,496 --a------ C:\WINDOWS\system32\atinppt2.ax
2008-06-15 03:58 . 2008-06-15 03:58 <DIR> d-------- C:\Program Files\ImgBurn
2008-06-15 01:01 . 2008-06-15 01:01 <DIR> d-------- C:\Program Files\MAXIMUM
2008-06-15 01:01 . 2008-06-15 01:01 <DIR> d-------- C:\Program Files\MASTER
2008-06-15 00:43 . 2004-03-29 16:23 90,112 --a------ C:\WINDOWS\unvise32.exe
2008-06-15 00:42 . 2008-06-15 00:53 <DIR> d-------- C:\Program Files\YVD
2008-06-14 15:49 . 2008-06-14 15:49 <DIR> d-------- C:\Program Files\AviSynth 2.5
2008-06-14 15:48 . 2008-06-15 00:32 <DIR> d-------- C:\Program Files\Audacity
2008-06-14 04:49 . 2008-06-14 04:48 691,545 --a------ C:\WINDOWS\unins000.exe
2008-06-14 04:49 . 2008-06-14 04:49 2,557 --a------ C:\WINDOWS\unins000.dat
2008-06-14 04:35 . 2008-06-14 04:35 <DIR> d-------- C:\Program Files\Any Video Converter Professional
2008-06-14 04:35 . 2008-06-14 04:35 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Any Video Converter Professional
2008-06-14 04:35 . 2008-06-14 04:36 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-14 04:33 . 2008-06-14 04:34 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Any Video Converter
2008-06-13 02:40 . 2008-06-13 02:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\acccore
2008-06-13 02:14 . 2008-06-13 02:14 <DIR> d-------- C:\Documents and Settings\Staind Blackheart\Application Data\Apple Computer
2008-06-13 02:11 . 2008-06-13 02:11 <DIR> d-------- C:\Program Files\K-Lite Mega Codec Pack 3.9.5
2008-06-13 00:08 . 2008-06-13 00:08 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-12 19:24 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 04:49 . 2008-06-12 04:49 <DIR> d-------- C:\Program Files\QuickTime
2008-06-12 04:48 . 2008-06-12 04:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-12 04:45 . 2008-06-12 04:45 <DIR> d-------- C:\Program Files\Apple Software Update
2008-06-12 04:45 . 2008-06-12 04:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-06-12 04:28 . 2004-08-03 23:10 61,056 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-06-12 04:28 . 2004-08-03 23:10 61,056 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-06-12 04:28 . 2004-08-03 23:10 53,248 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-06-12 04:28 . 2004-08-03 23:10 53,248 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-06-12 04:28 . 2001-08-17 13:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-06-12 04:28 . 2001-08-17 13:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-06-12 04:27 . 2004-08-03 23:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2008-06-12 04:27 . 2004-08-03 23:08 10,624 --a--c--- C:\WINDOWS\system32\dllcache\gameenum.sys
2008-06-12 04:27 . 2001-08-17 14:00 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys
2008-06-12 04:27 . 2001-08-17 14:00 2,944 --a--c--- C:\WINDOWS\system32\dllcache\msmpu401.sys
2008-05-27 10:50 . 2008-05-27 10:50 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-05-27 10:50 . 2008-05-27 10:50 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-26 02:13 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-26 01:59 --------- d-----w C:\Program Files\Java
2008-06-26 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-24 12:18 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\uTorrent
2008-06-21 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-21 16:37 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-18 07:10 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\dvdcss
2008-06-15 05:32 --------- d-----w C:\Program Files\WinASO
2008-06-15 05:04 --------- d-----w C:\Program Files\IrfanView
2008-06-14 19:05 --------- d-----w C:\Program Files\HP
2008-06-14 08:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 08:52 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 06:41 --------- d-----w C:\Program Files\AIM6
2008-06-13 06:04 --------- d-----w C:\Program Files\VideoLAN
2008-06-13 02:01 --------- d-----w C:\Documents and Settings\Staind Blackheart\Application Data\Yahoo!
2008-06-13 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-12 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-06-12 08:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-06-12 08:14 --------- d-----w C:\Program Files\Guild Wars
2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2007-07-29 02:56 774,144 ----a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-06-25_20.51.07.09 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-26 00:42:51 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-26 02:12:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2007-09-25 03:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-03-25 05:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-09-25 03:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-03-25 05:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-25 04:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-03-25 06:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-06-06 12:04 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33 125168]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 20:05 200704]
"b09311d1"="C:\WINDOWS\system32\tombdqru.dll" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24 258048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\YVD\\n00b-IRC.exe"=

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

.
Contents of the 'Scheduled Tasks' folder
"2008-06-22 00:17:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 22:14:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2008-06-25 22:20:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 02:20:41
ComboFix2.txt 2008-06-26 00:51:31

Pre-Run: 58,761,064,448 bytes free
Post-Run: 58,745,430,016 bytes free

182 --- E O F --- 2008-06-21 14:59:53


----------------------------------------------------------------------
And my newest Hijack This log:
----------------------------------------------------------------------


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:52 PM, on 6/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185486819562
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5471 bytes


My computer performance is much better. The rundll32 to the toburqhz file doesn't come up, no random browser hijacks and the speed seems fine. Basically I installed a new motherboard into my sis's old computer and now only had it not been updated in 6 months, it hasn't been fully updated to my security standards yet (I got lazy). But so far everything looks ok. Do you need anything that looks useless in my log you might be worth deleting besides Viewpoint? Just wondering.

[pskelley]

Thanks for returning your information and the feedback, first let me say your HJT log appears clean of malware:bigthumb: Great job with those complex instructions. Since it sounds like it is running like you want it to, information I post before we finish may help you to get it running better. Let's now remove combofix, it's a great program but it does not update.

Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.

http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png

and have MBAM take a look for malware leftovers:

Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file in your next reply.

Thanks...Phil

[The Frankman]

Before you replied I tried to indicate that I had deleted Symantec and are now using my copy of AVG 8 from my last computer. I won't be home from work until late, so I wanted to post this before I followed the next steps when I get home. I forgot to say three things:

a) I upgraded to IE 7 in the rare occasions I use it for security reasons.
b) Although my computer seems to be fine, I got a few "false positives" of a Win32. program (name escapes me). AVG deleted them, ran a check w/ AVG and Spybot after reboots, nothing there at all.
c) I noticed when I type in any forum (your forum for instance) I now can't click on the smileys, bold, italics, links, of stuff like that; it doesn't even highlight when I mouse over it. The only real plugin type of thing I deleted was old copies of Java, what could this be stemming from?

[pskelley]

In response to your post #8

Symantec/AVG: I run AVG 8 Free myself and that is not a problem as long as you run only one.

a) I understand if programs like IE, Adobe, Java and I am mentioning only a few, are not kept updated, hackers can still exploit them and I don't know enough about this to provide more information. Try asking google and it will usually provide. I know all you have to do for them to exploit an out of date program is visit an infected website and pass your mouse over an infected banner. No clicking necessary...the scum!

b) I would need more information, make sure Spybot S&D is up to date and fully immunized.

c) I have no idea, you did read the information in the link? You were to update to the newest version of Java and them remove any old versions. What you describe could be an issue with Java, if it continues see if they can help with it:

Test your installation:
- http://www.java.com/en/download/installed.jsp

http://sunsolve.sun.com/validateSLA.do?orignalTarget=show.do?target=home

Thanks

[The Frankman]

Before my log is posted, the problem I had with smileys and stuff is gone.

My Malwarebyte' log:

Malwarebytes' Anti-Malware 1.18
Database version: 895

1:59:27 AM 6/27/2008
mbam-log-6-27-2008 (01-59-27).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 133510
Time elapsed: 49 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

[pskelley]

Thanks for returning your information and the feedback, because this infection likes to mess with security programs, I would update and run your resident antivirus to make sure all is well, if you have issues, check with:
http://www.symantec.com/enterprise/support/index.jsp

I'll wish you safe surfing:bigthumb:

Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[The Frankman]

Okay, I just ran an Ad-Aware check, an AVG 8 check and a Spybot check. All green, no more problems. Thanks so much and I'll look out for any other things as I make the transition to make this computer up to snuff!