View Full Version : Virtumonde - Removal Problems
trialofdespair
2008-06-25, 06:43
I ran Spybot and some other things and I cant get it to die
Here's the log:
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:41 PM, on 6/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Sony\SmartWi Connection Utility\WCULauncher.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiTogglet.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Pidgin\pidgin.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [WCULauncher] C:\Program Files\Sony\SmartWi Connection Utility\WCULauncher.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Styler.lnk = ?
O4 - Global Startup: Atalho para VistaStart1.3.lnk = C:\Arquivos de programas\Windows Vista Basic\vistastart\VistaStart1.3.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SmartWiService - Sony Electronics, Inc - C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
--
End of file - 7491 bytes
trialofdespair
2008-06-25, 06:59
and the other log
ComboFix 08-06-20.4 - Homer 2008-06-24 21:46:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1397 [GMT -7:00]
Running from: C:\Documents and Settings\Homer\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\awtuuVPf.dll
C:\WINDOWS\system32\DKmoWvut.ini
C:\WINDOWS\system32\DKmoWvut.ini2
C:\WINDOWS\system32\fhkmnnpo.ini
C:\WINDOWS\system32\fhkmnnpo.ini2
C:\WINDOWS\system32\fPVuutwa.ini
C:\WINDOWS\system32\fPVuutwa.ini2
C:\WINDOWS\system32\GiOnTvut.ini
C:\WINDOWS\system32\GiOnTvut.ini2
C:\WINDOWS\system32\ihkQBcdd.ini
C:\WINDOWS\system32\ihkQBcdd.ini2
C:\WINDOWS\system32\kTwacccf.ini
C:\WINDOWS\system32\kTwacccf.ini2
C:\WINDOWS\system32\MWGgfMoq.ini
C:\WINDOWS\system32\MWGgfMoq.ini2
C:\WINDOWS\system32\OqWvGfhk.ini
C:\WINDOWS\system32\OqWvGfhk.ini2
C:\WINDOWS\system32\oUtvFMoq.ini
C:\WINDOWS\system32\oUtvFMoq.ini2
.
((((((((((((((((((((((((( Files Created from 2008-05-25 to 2008-06-25 )))))))))))))))))))))))))))))))
.
2008-06-24 21:34 . 2008-06-24 21:34 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-24 19:30 . 2008-06-24 19:30 <DIR> d-------- C:\VundoFix Backups
2008-06-24 18:14 . 2008-06-24 18:15 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-06-23 16:30 . 2008-06-23 16:30 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-06-22 18:16 . 2008-06-24 20:58 847 --a------ C:\WINDOWS\wininit.ini
2008-06-22 17:48 . 2008-06-22 17:48 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-22 16:43 . 2008-06-22 16:43 25,088 --a------ C:\WINDOWS\system32\xxyxyWNE.dll
2008-06-17 14:11 . 2008-06-17 14:11 244 --ah----- C:\sqmnoopt18.sqm
2008-06-17 14:11 . 2008-06-17 14:11 232 --ah----- C:\sqmdata18.sqm
2008-06-17 13:58 . 2008-06-17 13:58 244 --ah----- C:\sqmnoopt17.sqm
2008-06-17 13:58 . 2008-06-17 13:58 232 --ah----- C:\sqmdata17.sqm
2008-06-17 10:11 . 2008-06-17 10:11 244 --ah----- C:\sqmnoopt16.sqm
2008-06-17 10:11 . 2008-06-17 10:11 232 --ah----- C:\sqmdata16.sqm
2008-06-17 08:37 . 2008-06-17 08:37 244 --ah----- C:\sqmnoopt15.sqm
2008-06-17 08:37 . 2008-06-17 08:37 232 --ah----- C:\sqmdata15.sqm
2008-06-16 21:14 . 2008-06-16 21:14 244 --ah----- C:\sqmnoopt14.sqm
2008-06-16 21:14 . 2008-06-16 21:14 232 --ah----- C:\sqmdata14.sqm
2008-06-16 20:51 . 2008-06-16 20:51 244 --ah----- C:\sqmnoopt13.sqm
2008-06-16 20:51 . 2008-06-16 20:51 232 --ah----- C:\sqmdata13.sqm
2008-06-16 20:46 . 2008-06-16 20:46 244 --ah----- C:\sqmnoopt12.sqm
2008-06-16 20:46 . 2008-06-16 20:46 232 --ah----- C:\sqmdata12.sqm
2008-06-16 20:43 . 2008-06-16 20:43 244 --ah----- C:\sqmnoopt11.sqm
2008-06-16 20:43 . 2008-06-16 20:43 232 --ah----- C:\sqmdata11.sqm
2008-06-16 20:33 . 2008-06-16 20:33 244 --ah----- C:\sqmnoopt10.sqm
2008-06-16 20:33 . 2008-06-16 20:33 232 --ah----- C:\sqmdata10.sqm
2008-06-15 21:55 . 2008-06-15 21:55 244 --ah----- C:\sqmnoopt09.sqm
2008-06-15 21:55 . 2008-06-15 21:55 232 --ah----- C:\sqmdata09.sqm
2008-06-15 21:48 . 2008-06-15 21:48 244 --ah----- C:\sqmnoopt08.sqm
2008-06-15 21:48 . 2008-06-15 21:48 232 --ah----- C:\sqmdata08.sqm
2008-06-15 21:40 . 2008-06-15 21:40 244 --ah----- C:\sqmnoopt07.sqm
2008-06-15 21:40 . 2008-06-15 21:40 232 --ah----- C:\sqmdata07.sqm
2008-06-15 21:28 . 2008-06-15 21:28 244 --ah----- C:\sqmnoopt06.sqm
2008-06-15 21:28 . 2008-06-15 21:28 232 --ah----- C:\sqmdata06.sqm
2008-06-15 21:21 . 2008-06-15 21:21 244 --ah----- C:\sqmnoopt05.sqm
2008-06-15 21:21 . 2008-06-15 21:21 232 --ah----- C:\sqmdata05.sqm
2008-06-15 21:15 . 2008-06-15 21:15 244 --ah----- C:\sqmnoopt04.sqm
2008-06-15 21:15 . 2008-06-15 21:15 232 --ah----- C:\sqmdata04.sqm
2008-06-15 21:05 . 2008-06-15 21:05 244 --ah----- C:\sqmnoopt03.sqm
2008-06-15 21:05 . 2008-06-15 21:05 232 --ah----- C:\sqmdata03.sqm
2008-06-12 17:57 . 2008-06-17 18:07 <DIR> d-------- C:\Documents and Settings\Homer\Application Data\skypePM
2008-06-12 17:57 . 2008-06-12 17:57 48 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-12 17:56 . 2008-06-12 17:56 <DIR> d-------- C:\Program Files\Skype
2008-06-12 17:56 . 2008-06-12 17:56 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-12 17:56 . 2008-06-17 19:11 <DIR> d-------- C:\Documents and Settings\Homer\Application Data\Skype
2008-06-08 08:01 . 2008-06-08 08:01 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-06-04 11:14 . 2008-06-04 11:14 268 --ah----- C:\sqmdata02.sqm
2008-06-04 11:14 . 2008-06-04 11:14 244 --ah----- C:\sqmnoopt02.sqm
2008-06-01 23:30 . 2008-06-01 23:30 <DIR> d-------- C:\Program Files\Recuva
2008-06-01 23:21 . 2008-06-01 23:21 <DIR> d-------- C:\Program Files\Defraggler
2008-06-01 16:07 . 2008-06-19 00:29 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-01 16:07 . 2008-06-01 16:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-01 15:22 . 2008-06-01 15:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-06-01 13:30 . 2008-06-01 13:30 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-01 13:03 . 2008-06-01 13:04 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-06-01 12:09 . 2008-06-01 12:09 <DIR> d-------- C:\Inetpub
2008-06-01 11:21 . 2008-06-01 11:43 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-06-01 10:27 . 2005-09-01 11:03 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2008-06-01 10:27 . 2005-09-01 11:03 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2008-06-01 10:26 . 2008-06-01 10:26 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-06-01 10:26 . 2004-07-26 16:16 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll
2008-06-01 10:26 . 2004-07-26 16:16 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll
2008-06-01 10:26 . 2004-07-26 16:16 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll
2008-06-01 10:26 . 2004-07-09 08:43 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-06-01 10:26 . 2004-07-26 16:16 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll
2008-06-01 10:26 . 2006-01-12 15:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-06-01 10:26 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 04:46 --------- d-----w C:\Documents and Settings\Homer\Application Data\.purple
2008-06-25 04:01 --------- d-----w C:\Documents and Settings\Homer\Application Data\uTorrent
2008-06-25 02:28 --------- d-----w C:\Documents and Settings\Homer\Application Data\MegauploadToolbar
2008-06-24 05:03 --------- d-----w C:\Program Files\Gravity
2008-06-13 00:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-12 05:55 --------- d-----w C:\Documents and Settings\Homer\Application Data\gtk-2.0
2008-06-07 04:27 --------- d-----w C:\Program Files\Pidgin
2008-06-02 01:10 --------- d-----w C:\Program Files\Many Faces of Go 11.0
2008-06-01 18:33 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 17:26 --------- d-----w C:\Program Files\Ahead
2008-06-01 17:21 --------- d-----w C:\Program Files\Trillian
2008-05-29 21:53 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2008-05-23 04:07 --------- d-----w C:\Documents and Settings\Homer\Application Data\LimeWire
2008-05-21 19:43 --------- d-----w C:\Documents and Settings\Homer\Application Data\U3
2008-05-11 14:43 --------- d-----w C:\Documents and Settings\Homer\Application Data\Protector Suite
2008-05-09 18:35 --------- d-----w C:\Program Files\StepMania
2008-05-03 04:36 --------- d-----w C:\Program Files\Combined Community Codec Pack
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F61041F-486A-4831-87E6-DB6B7A76DE99}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E4F01D2-FA9B-4C99-BDB4-48C6F5E8BAE4}]
C:\WINDOWS\system32\tuvWomKD.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77FDBED8-9F03-4AFC-BFE6-3BDA49B72A99}]
C:\WINDOWS\system32\ddcBQkhi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81430BDC-7ACD-4F7B-99CA-5BF7F0390AC4}]
C:\WINDOWS\system32\qoMfgGWM.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6B256DB-8D96-493D-A4E3-54C1FD0359E6}]
C:\WINDOWS\system32\khfGvWqO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A70206DC-3DC6-4117-A0A3-84D37C016287}]
C:\WINDOWS\system32\qoMFvtUo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC8101EE-0133-43D5-8EF4-A03834B9151D}]
C:\WINDOWS\system32\tuvTnOiG.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5E84927-CFF0-4CA3-A068-02E7C01C1E7C}]
2008-06-22 16:43 25088 --a------ C:\WINDOWS\system32\xxyxyWNE.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E052DCF6-0A1A-47FD-BD56-D69123D2CCC5}]
C:\WINDOWS\system32\fcccawTk.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4C91FA5-9017-42C1-BF6F-A52B09692948}]
C:\WINDOWS\system32\opnnmkhf.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-01-30 18:59 219952]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-11-17 19:47 118784]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 15:12 32768]
"Switcher.exe"="C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 12:11 176128]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-02-28 14:25 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-02-28 14:25 602182]
"WCULauncher"="C:\Program Files\Sony\SmartWi Connection Utility\WCULauncher.exe" [2006-02-07 20:28 73728]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 14:03 56080 C:\WINDOWS\KHALMNPR.Exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 15:40 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-20 17:45 7561216]
C:\Documents and Settings\Homer\Start Menu\Programs\Startup\
Styler.lnk - C:\Documents and Settings\Homer\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2008-01-20 13:09:08 15086]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C5E84927-CFF0-4CA3-A068-02E7C01C1E7C}"= C:\WINDOWS\system32\xxyxyWNE.dll [2008-06-22 16:43 25088]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-07-26 13:16 72208 c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
fusstub.dll 2006-02-22 18:11 39936 C:\WINDOWS\system32\fusstub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2006-03-09 14:51 73728 C:\WINDOWS\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyxyWNE]
xxyxyWNE.dll 2008-06-22 16:43 25088 C:\WINDOWS\system32\xxyxyWNE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-05-30 15:54 21718312 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Trillian\\trillian.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"C:\\Program Files\\Pidgin\\pidgin.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 shpf;Sony HDD Protection Filter Driver;C:\WINDOWS\system32\DRIVERS\shpf.sys [2005-11-21 14:06]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 16:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 16:16]
R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-02-22 18:13]
R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-02-22 18:13]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-21 11:19]
R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2003-06-18 16:12]
R3 ti21sony;ti21sony;C:\WINDOWS\system32\drivers\ti21sony.sys [2006-02-21 19:32]
S3 npkycryp;npkycryp;C:\Program Files\Gravity\RO\npkycryp.sys []
S3 XDva165;XDva165;C:\WINDOWS\system32\XDva165.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{321bc4c4-fabb-11dc-820c-0018de624c2b}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bbe5ac3-130a-11dd-8238-0018de624c2b}]
\Shell\AutoRun\command - i.exe
\Shell\explore\Command - i.exe
\Shell\open\Command - i.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87ab033a-a9eb-11dc-81aa-0018de624c2b}]
\Shell\Auto\command - MSOCache\doWTP_RESTORE.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d41681e-fa94-11dc-820b-0018de624c2b}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9b5e11a-26df-11dd-8255-0018de624c2b}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca44199c-fc3d-11dc-8212-0018de624c2b}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef3e6248-028e-11dd-8222-0018de624c2b}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-25 04:00:00 C:\WINDOWS\Tasks\B9AD17569CA68B4E.job"
- c:\docume~1\homer\applic~1\newdrv~1\Acid third soft.exe
"2008-06-18 07:10:27 C:\WINDOWS\Tasks\uTorrent.job"
- C:\Program Files\uTorrent\uTorrent.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 21:51:41
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\xxyxyWNE.dll
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\SETUPAPI.dll
-> ?:\WINDOWS\system32\SETUPAPI.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiTogglet.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
.
**************************************************************************
.
Completion time: 2008-06-24 21:56:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-25 04:56:13
Pre-Run: 56,888,131,584 bytes free
Post-Run: 56,824,582,144 bytes free
280 --- E O F --- 2007-09-22 15:36:29
I think you missed Do NOT run 'fixes' before helpers have analyzed HJT log (http://forums.spybot.info/showthread.php?t=16806) (ran ComboFix though it shouldn't be used without supervision) sticky ;)
Please uninstall Spybot for now to make sure TeaTimer won't interfere fixing. You may reinstall it after system is clean.
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\system32\xxyxyWNE.dll
C:\WINDOWS\Tasks\B9AD17569CA68B4E.job
Folder::
C:\VundoFix Backups
c:\docume~1\homer\applic~1\newdrv~1
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F61041F-486A-4831-87E6-DB6B7A76DE99}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E4F01D2-FA9B-4C99-BDB4-48C6F5E8BAE4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{77FDBED8-9F03-4AFC-BFE6-3BDA49B72A99}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81430BDC-7ACD-4F7B-99CA-5BF7F0390AC4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6B256DB-8D96-493D-A4E3-54C1FD0359E6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A70206DC-3DC6-4117-A0A3-84D37C016287}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC8101EE-0133-43D5-8EF4-A03834B9151D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5E84927-CFF0-4CA3-A068-02E7C01C1E7C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E052DCF6-0A1A-47FD-BD56-D69123D2CCC5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4C91FA5-9017-42C1-BF6F-A52B09692948}]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C5E84927-CFF0-4CA3-A068-02E7C01C1E7C}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyxyWNE]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{321bc4c4-fabb-11dc-820c-0018de624c2b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bbe5ac3-130a-11dd-8238-0018de624c2b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87ab033a-a9eb-11dc-81aa-0018de624c2b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9b5e11a-26df-11dd-8255-0018de624c2b}]
Save this as
CFScript
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.nl/scanforvirus-en/kavwebscan.html). You will be prompted to install an ActiveX component from Kaspersky, click Yes.
The program will launch and start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings and select the following:
Scan using the following Anti-Virus database:
Extended (If available, otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK.
Under
select a target to scan
, select My Computer.
The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.Once the scan is complete:
Click on the Save as Text button.
Save the file to your desktop.
Copy and paste that information into your next post if the AV content will fit into one post only. Post a fresh hjt log (without forgetting above meantioned ComboFix resultant log) too.
Note for Internet Explorer 7 users: If at any time you have trouble with the Accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.
If having a problme doing the above
Make sure that your Internet security settings are set to default values.
To set default security settings for Internet Explorer:
* Open Internet Explorer.
* Go to the Tools menu, then choose Internet Options.
* Click on the Security tab.
* Make sure that all four item (Internet, Local intranet, Trusted sites, and Restricted sites) are set to their default settings.