acpiz.dll has infiltrated processes

[icer01]

I'm pretty sure this happened the other day, as it caused the computer to freak out. The dll [B]acpiz.dll is a module in lots of system processes [winlogon.exe, SyncServices.exe, mdm.exe, explorer.exe and also in the Spybot Resident's Teatimer.exe process. I think it adds itself to any new application process you start.] Anyway, I can't find a file called acpiz.dll anywhere in the system so I guess it gets hidden or auto-generated or whatever. Spybot scan does not detect any malware/virus behind this or anything at all.

Also in list of strangely executed modules is WINotify.dll with value SensLogn [note, not WLNotify], some sites seem to say there's a malicious variant of this. It's been lurking in the computer for about a month, but it didn't seem to cause any noticeable problems except that the Spybot Resident TeaTimer.exe doesn't seem to work any more and always crashes on shutdown. I left it because some sites claim the file is benign.

There are startup entries for both acpiz.dll and WINotify.dll

Located: WinLogon, acpiz
command: acpiz.dll
file: acpiz.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E

If I uncheck them in Spybot, they are added back immediately, I assume by the running modules in all the processes. When I unchecked the entires in Runalyzer, Runalyzer always crashed. The acpiz.dll is always started and added to processes even in Safe Mode without Networking.

Some sites claimed that acpiz.dll was caused by the Goldun.fam virus, I found a few sites with instructions for manual removal, but they were all for files and registry keys which didn't exist at all on my computer. Maybe it was for an older variant. Spybot scan didn't detect it.

On one site I found a program which claimed to be able to clean Goldun.fam, it seemed to be a general legitimate anti-spyware product so I thought I may as well try it. But perhaps the malware was built to disrupt it or something because it had some kind of massive error, after which Windows couldn't load the Start Bar program whenever it tried to start up, even in Safe Mode. [acpiz.dll was still running though.] The only way I could access the filesystem was to boot to Safe Mode with Command Prompt and run explorer.exe from the command prompt, in the end I restored a System Restore Point from 3 weeks ago, which restored the corrupted Start Menu shell, but the virus/malware is still present.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:18:59 AM, on 14/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dirkey2\dirkey.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = LYNX 0.98b
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Dirkey] C:\Program Files\Dirkey2\dirkey.exe
O4 - HKCU\..\Run: [Quick Folders] rundll32 qfolders.cpl,Load
O4 - Startup: BHODemon 2.0.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Office Startup.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\__c0064710.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Unknown owner - VundoFixSVC.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--
End of file - 3616 bytes

The RunAlyzer program also would generate something it called a 'HijackThis log file' I'm not sure if it's the one I'm supposed to post here but it did seem to mention something about the acpiz.dll [getting registered maybe???]

Logfile of RunAlyzer 0.7.3. Copyright © 2000-2007 Safer Networking Limited. All rights reserved.
Scan saved at 14/11/2008 4:48:56 AM
Platform: Windows XP (Build: 2600) Service Pack 1 (5.1.2600)

Running processes:
[System]
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Safer Networking\RunAlyzer\RunAlyzer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dirkey2\dirkey.exe
C:\WINDOWS\System32\rundll32.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O20 - Winlogon Notify: cscdll = cscdll.dll
O20 - Winlogon Notify: acpiz = acpiz.dll
O20 - Winlogon Notify: wlballoon = wlnotify.dll
O20 - Winlogon Notify: SensLogn = WlNotify.dll
O20 - Winlogon Notify: Schedule = wlnotify.dll
O20 - Winlogon Notify: sclgntfy = sclgntfy.dll
O20 - Winlogon Notify: termsrv = wlnotify.dll
O20 - Winlogon Notify: ScCertProp = wlnotify.dll
O20 - Winlogon Notify: MCPClient = C:\Program Files\Common Files\Stardock\mcpstub.dll
O20 - Winlogon Notify: cryptnet = cryptnet.dll
O20 - Winlogon Notify: crypt32chain = crypt32.dll
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
O4 - HKCU\..\Run: [Quick Folders] C:\WINDOWS\System32\qfolders.cpl
O4 - HKCU\..\Run: [Dirkey] C:\Program Files\Dirkey2\dirkey.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O23 - Service: Microsoft ACPI Driver (ACPI) - /owner unsupported/ - Sys
O23 - Service: VPower Control Service (acup) - /owner unsupported/ - sys
O23 - Service: Adobe LM Service (Adobe LM Service) - /owner unsupported/ - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Microsoft Kernel Acoustic Echo Canceller (aec) - /owner unsupported/ - sys
O23 - Service: AFD Networking Support Environment (AFD) - /owner unsupported/ - \Sy
O23 - Service: Alcatel SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) (alcan5wn) - /owner unsupported/ - Sys
O23 - Service: Alcatel Speed Touch ADSL Modem ATM Transport (alcaudsl) - /owner unsupported/ - Sys
O23 - Service: Alerter (Alerter) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Application Layer Gateway Service (ALG) - /owner unsupported/ - C:\WINDOWS\System32\alg.exe
O23 - Service: AMON (AMON) - /owner unsupported/ - \Sy
O23 - Service: Application Management (AppMgmt) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: ASCTRM (ASCTRM) - /owner unsupported/ -
O23 - Service: ASP.NET State Service (aspnet_state) - /owner unsupported/ - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
O23 - Service: RAS Asynchronous Media Driver (AsyncMac) - /owner unsupported/ - Sys
O23 - Service: Standard IDE/ESDI Hard Disk Controller (atapi) - /owner unsupported/ - Sys
O23 - Service: Ati HotKey Poller (Ati HotKey Poller) - /owner unsupported/ - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart (ATI Smart) - /owner unsupported/ - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATM ARP Client Protocol (Atmarpc) - /owner unsupported/ - Sys
O23 - Service: Windows Audio (AudioSrv) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Audio Stub Driver (audstub) - /owner unsupported/ - Sys
O23 - Service: Autodesk Licensing Service (Autodesk Licensing Service) - /owner unsupported/ - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Computer Browser (Browser) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: CD-ROM Driver (Cdrom) - /owner unsupported/ - Sys
O23 - Service: Indexing Service (CiSvc) - /owner unsupported/ - C:\WINDOWS\system32\cisvc.exe
O23 - Service: ClipBook (ClipSrv) - /owner unsupported/ - C:\WINDOWS\system32\clipsrv.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - /owner unsupported/ - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
O23 - Service: COM+ System Application (COMSysApp) - /owner unsupported/ - C:\WINDOWS\System32\dllhost.exe
O23 - Service: Cryptographic Services (CryptSvc) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: DHCP Client (Dhcp) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Disk Driver (Disk) - /owner unsupported/ - Sys
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - /owner unsupported/ - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Logical Disk Manager (dmserver) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft Kernel DLS Syntheiszer (DMusic) - /owner unsupported/ - sys
O23 - Service: DNS Client (Dnscache) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft Kernel DRM Audio Descrambler (drmkaud) - /owner unsupported/ - sys
O23 - Service: Error Reporting Service (ERSvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Event Log (Eventlog) - /owner unsupported/ - C:\WINDOWS\system32\services.exe
O23 - Service: COM+ Event System (EventSystem) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Fast User Switching Compatibility (FastUserSwitchingCompatibility) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Floppy Disk Controller Driver (Fdc) - /owner unsupported/ - Sys
O23 - Service: Floppy Disk Driver (Flpydisk) - /owner unsupported/ - Sys
O23 - Service: Volume Manager Driver (Ftdisk) - /owner unsupported/ - Sys
O23 - Service: Game Port Enumerator (gameenum) - /owner unsupported/ - Sys
O23 - Service: GEAR CDRom Filter (GEARAspiWDM) - /owner unsupported/ - SYS
O23 - Service: Generic Packet Classifier (Gpc) - /owner unsupported/ - Sys
O23 - Service: Help and Support (helpsvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Human Interface Device Access (HidServ) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft HID Class Driver (HidUsb) - /owner unsupported/ - Sys
O23 - Service: i8042 Keyboard and PS/2 Mouse Port Driver (i8042prt) - /owner unsupported/ - Sys
O23 - Service: CD-Burning Filter Driver (Imapi) - /owner unsupported/ - Sys
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - /owner unsupported/ - C:\WINDOWS\System32\imapi.exe
O23 - Service: IP Traffic Filter Driver (IpFilterDriver) - /owner unsupported/ - Sys
O23 - Service: IP in IP Tunnel Driver (IpInIp) - /owner unsupported/ - Sys
O23 - Service: IP Network Address Translator (IpNat) - /owner unsupported/ - Sys
O23 - Service: iPod Service (iPodService) - /owner unsupported/ - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IPSEC driver (IPSec) - /owner unsupported/ - Sys
O23 - Service: IR Enumerator Service (IRENUM) - /owner unsupported/ - Sys
O23 - Service: PnP ISA/EISA Bus Driver (isapnp) - /owner unsupported/ - Sys
O23 - Service: Keyboard Class Driver (Kbdclass) - /owner unsupported/ - Sys
O23 - Service: Microsoft Kernel Wave Audio Mixer (kmixer) - /owner unsupported/ - sys
O23 - Service: Server (lanmanserver) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Workstation (lanmanworkstation) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: TCP/IP NetBIOS Helper (LmHosts) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Macromedia Licensing Service (Macromedia Licensing Service) - /owner unsupported/ - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - /owner unsupported/ - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: Driver for MagicISO SCSI Host Controller (mcdbus) - /owner unsupported/ - Sys
O23 - Service: Machine Debug Manager (MDM) - /owner unsupported/ - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
O23 - Service: Messenger (Messenger) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Canon scaner FB310 (METROP) - /owner unsupported/ - Sys
O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - /owner unsupported/ - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Mouse Class Driver (Mouclass) - /owner unsupported/ - Sys
O23 - Service: Mouse HID Driver (mouhid) - /owner unsupported/ - Sys
O23 - Service: WebDav Client Redirector (MRxDAV) - /owner unsupported/ - Sys
O23 - Service: MRXSMB (MRxSmb) - /owner unsupported/ - Sys
O23 - Service: Distributed Transaction Coordinator (MSDTC) - /owner unsupported/ - C:\WINDOWS\System32\msdtc.exe
O23 - Service: Windows Installer (MSIServer) - /owner unsupported/ - C:\WINDOWS\System32\msiexec.exe
O23 - Service: Microsoft Streaming Service Proxy (MSKSSRV) - /owner unsupported/ - sys
O23 - Service: Microsoft Streaming Clock Proxy (MSPCLOCK) - /owner unsupported/ - sys
O23 - Service: Microsoft Streaming Quality Manager Proxy (MSPQM) - /owner unsupported/ - sys
O23 - Service: Microsoft MPU-401 MIDI UART Driver (ms_mpu401) - /owner unsupported/ - sys
O23 - Service: Mup (Mup) - /owner unsupported/ -
O23 - Service: MxlW2k (MxlW2k) - /owner unsupported/ -
O23 - Service: Maxtor OneTouch Security Driver (MXOPSWD) - /owner unsupported/ - Sys
O23 - Service: NDIS System Driver (NDIS) - /owner unsupported/ -
O23 - Service: Remote Access NDIS TAPI Driver (NdisTapi) - /owner unsupported/ - Sys
O23 - Service: NDIS Usermode I/O Protocol (Ndisuio) - /owner unsupported/ - Sys
O23 - Service: Remote Access NDIS WAN Driver (NdisWan) - /owner unsupported/ - Sys
O23 - Service: NetBIOS Interface (NetBIOS) - /owner unsupported/ - Sys
O23 - Service: NetBios over Tcpip (NetBT) - /owner unsupported/ - Sys
O23 - Service: Network DDE (NetDDE) - /owner unsupported/ - C:\WINDOWS\system32\netdde.exe
O23 - Service: Network DDE DSDM (NetDDEdsdm) - /owner unsupported/ - C:\WINDOWS\system32\netdde.exe
O23 - Service: Net Logon (Netlogon) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: Network Connections (Netman) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Network Location Awareness (NLA) (Nla) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: nod32drv (nod32drv) - /owner unsupported/ - \Sy
O23 - Service: NOD32 Kernel Service (NOD32krn) - /owner unsupported/ - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NT LM Security Support Provider (NtLmSsp) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: Removable Storage (NtmsSvc) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Service for NVIDIA(R) nForce(TM) Audio Enumerator (nvax) - /owner unsupported/ - sys
O23 - Service: NVIDIA nForce MCP Networking Adapter Driver (NVENET) - /owner unsupported/ - Sys
O23 - Service: Service for NVIDIA(R) nForce(TM) Audio (nvnforce) - /owner unsupported/ - sys
O23 - Service: NVIDIA nForce AGP Bus Filter (nv_agp) - /owner unsupported/ - Sys
O23 - Service: IPX Traffic Filter Driver (NwlnkFlt) - /owner unsupported/ - Sys
O23 - Service: IPX Traffic Forwarder Driver (NwlnkFwd) - /owner unsupported/ - Sys
O23 - Service: Office Source Engine (ose) - /owner unsupported/ - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
O23 - Service: Parallel port driver (Parport) - /owner unsupported/ - Sys
O23 - Service: PCI Bus Driver (PCI) - /owner unsupported/ - Sys
O23 - Service: Plug and Play (PlugPlay) - /owner unsupported/ - C:\WINDOWS\system32\services.exe
O23 - Service: IPSEC Services (PolicyAgent) - /owner unsupported/ - C:\WINDOWS\System32\lsass.exe
O23 - Service: WAN Miniport (PPTP) (PptpMiniport) - /owner unsupported/ - Sys
O23 - Service: Processor Driver (Processor) - /owner unsupported/ - Sys
O23 - Service: Protected Storage (ProtectedStorage) - /owner unsupported/ - C:\WINDOWS\system32\lsass.exe
O23 - Service: QoS Packet Scheduler (PSched) - /owner unsupported/ - Sys
O23 - Service: Direct Parallel Link Driver (Ptilink) - /owner unsupported/ - Sys
O23 - Service: Remote Access Auto Connection Driver (RasAcd) - /owner unsupported/ - Sys
O23 - Service: Remote Access Auto Connection Manager (RasAuto) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: WAN Miniport (L2TP) (Rasl2tp) - /owner unsupported/ - Sys
O23 - Service: Remote Access Connection Manager (RasMan) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Remote Access PPPOE Driver (RasPppoe) - /owner unsupported/ - Sys
O23 - Service: Direct Parallel (Raspti) - /owner unsupported/ - Sys
O23 - Service: Rdbss (Rdbss) - /owner unsupported/ - Sys
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - /owner unsupported/ - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Digital CD Audio Playback Filter Driver (redbook) - /owner unsupported/ - Sys
O23 - Service: Routing and Remote Access (RemoteAccess) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft Legacy Modem Driver (ROOTMODEM) - /owner unsupported/ - Sys
O23 - Service: Remote Procedure Call (RPC) Locator (RpcLocator) - /owner unsupported/ - C:\WINDOWS\System32\locator.exe
O23 - Service: Remote Procedure Call (RPC) (RpcSs) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: QoS RSVP (RSVP) - /owner unsupported/ - C:\WINDOWS\System32\rsvp.exe
O23 - Service: Security Accounts Manager (SamSs) - /owner unsupported/ - C:\WINDOWS\system32\lsass.exe
O23 - Service: Smart Card Helper (SCardDrv) - /owner unsupported/ - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Smart Card (SCardSvr) - /owner unsupported/ - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Task Scheduler (Schedule) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Secdrv (Secdrv) - /owner unsupported/ - Sys
O23 - Service: Secondary Logon (seclogon) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: System Event Notification (SENS) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Serenum Filter Driver (serenum) - /owner unsupported/ - Sys
O23 - Service: Serial port driver (Serial) - /owner unsupported/ - Sys
O23 - Service: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS) (SharedAccess) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Shell Hardware Detection (ShellHWDetection) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Microsoft Kernel Audio Splitter (splitter) - /owner unsupported/ - sys
O23 - Service: Print Spooler (Spooler) - /owner unsupported/ - C:\WINDOWS\system32\spoolsv.exe
O23 - Service: System Restore Filter Driver (sr) - /owner unsupported/ - Sys
O23 - Service: System Restore Service (srservice) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Srv (Srv) - /owner unsupported/ - Sys
O23 - Service: SSDP Discovery Service (SSDPSRV) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Windows Image Acquisition (WIA) (stisvc) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: %SvcDesc% (StMp3Rec) - /owner unsupported/ - Sys
O23 - Service: StyleXPHelper (StyleXPHelper) - /owner unsupported/ - C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
O23 - Service: StyleXPService (StyleXPService) - /owner unsupported/ - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Software Bus Driver (swenum) - /owner unsupported/ - Sys
O23 - Service: Microsoft Kernel GS Wavetable Synthesizer (swmidi) - /owner unsupported/ - sys
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - /owner unsupported/ - C:\WINDOWS\System32\dllhost.exe
O23 - Service: Microsoft Kernel System Audio Device (sysaudio) - /owner unsupported/ - sys
O23 - Service: Performance Logs and Alerts (SysmonLog) - /owner unsupported/ - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Serial Tablet Port Driver (Tablet2k) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\Tablet2k.sys
O23 - Service: Telephony (TapiSrv) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Tablet Class Driver (TClass2k) - /owner unsupported/ - Sys
O23 - Service: TCP/IP Protocol Driver (Tcpip) - /owner unsupported/ - Sys
O23 - Service: Terminal Device Driver (TermDD) - /owner unsupported/ - Sys
O23 - Service: Terminal Services (TermService) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Themes (Themes) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Distributed Link Tracking Client (TrkWks) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: HID Tablet Port Driver (UCTblHid) - /owner unsupported/ - Sys
O23 - Service: Windows User Mode Driver Framework (UMWdf) - /owner unsupported/ - C:\WINDOWS\System32\wdfmgr.exe
O23 - Service: Microcode Update Driver (Update) - /owner unsupported/ - Sys
O23 - Service: Upload Manager (uploadmgr) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Universal Plug and Play Device Host (upnphost) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Uninterruptible Power Supply (UPS) - /owner unsupported/ - C:\WINDOWS\System32\ups.exe
O23 - Service: Microsoft USB 2.0 Enhanced Host Controller Miniport Driver (usbehci) - /owner unsupported/ - Sys
O23 - Service: USB2 Enabled Hub (usbhub) - /owner unsupported/ - Sys
O23 - Service: Microsoft USB Open Host Controller Miniport Driver (usbohci) - /owner unsupported/ - Sys
O23 - Service: USB Mass Storage Driver (USBSTOR) - /owner unsupported/ - Sys
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - /owner unsupported/ - C:\Program Files\MSN Messenger\usnsvc.exe
O23 - Service: Volume Shadow Copy (VSS) - /owner unsupported/ - C:\WINDOWS\System32\vssvc.exe
O23 - Service: VundoFix Service (VundoFixSvc) - /owner unsupported/ - VundoFixSVC.exe
O23 - Service: Windows Time (W32Time) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Remote Access IP ARP Driver (Wanarp) - /owner unsupported/ - Sys
O23 - Service: Microsoft WINMM WDM Audio Compatibility Driver (wdmaud) - /owner unsupported/ - sys
O23 - Service: WebClient (WebClient) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: Windows Management Instrumentation (winmgmt) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: WinTab Service (WinTabService) - /owner unsupported/ - C:\WINDOWS\System32\Drivers\WTSRV.EXE
O23 - Service: Portable Media Serial Number Service (WmdmPmSN) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O23 - Service: WMI Performance Adapter (WmiApSrv) - /owner unsupported/ - C:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: WpdUsb (WpdUsb) - /owner unsupported/ - Sys
O23 - Service: Windows Socket 2.0 Non-IFS Service Provider Support Environment (WS2IFSL) - /owner unsupported/ - \Sy
O23 - Service: Automatic Updates (wuauserv) - /owner unsupported/ - C:\WINDOWS\system32\svchost.exe
O23 - Service: Wireless Zero Configuration (WZCSVC) - /owner unsupported/ - C:\WINDOWS\System32\svchost.exe
O16 - DPF: DirectAnimation Java Classes (DirectAnimation Java Classes) - file://C:\WINDOWS\Java\classes\dajava.cab
O16 - DPF: Microsoft XML Parser for Java (Microsoft XML Parser for Java) - file://C:\WINDOWS\Java\classes\xmldso.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} () - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {32A155BD-68EC-404E-A14F-72A851C0811D} () - http://cp1.webng.com/client/fm/WebNG-Uploader.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38158.1974189815
O16 - DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2) - http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0) - http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} () - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Blade81]

Hi

Navigate into C:\Program Files\Trend Micro\HijackThis folder and rename HijackThis.exe file -> something.exe. Post a fresh hjt log when renaming is done :)

[icer01]

It seems to be identical.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:11:52 AM, on 15/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Dirkey2\dirkey.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\renamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Dirkey] C:\Program Files\Dirkey2\dirkey.exe
O4 - HKCU\..\Run: [Quick Folders] rundll32 qfolders.cpl,Load
O4 - Startup: BHODemon 2.0.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Office Startup.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: C:\WINDOWS\System32\__c0064710.dat
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Unknown owner - VundoFixSVC.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--

I think the virus might still be able to detect it, the HijackThis application will show the 'Info on selected item..' dialog box for every extry except 'F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\' where it just doesn't show anything.

[Blade81]

Hi

Ok. Let's see what we can do :)


Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode

On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer

Download ResetTeaTimer.bat to the Desktop
http://downloads.subratam.org/ResetTeaTimer.bat
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer (and preventing TeaTimer to restore them upon reactivation).


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:


Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.


Click Yes to allow ComboFix to continue scanning for malware.


When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

[icer01]

I think ComboFix managed to fix the problem. At least, acpiz.dll isn't added to processes any more.

ComboFix 08-11-13.02 - Johnson 2008-11-17 15:16:41.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.1118 [GMT 11:00]
Running from: c:\documents and settings\Johnson\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Johnson\Application Data\addon.dat
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\BM834d2100.txt
c:\windows\BM834d2100.xml
c:\windows\IE4 Error Log.txt
c:\windows\system32\bdhomwmx.ini
c:\windows\system32\CdJklnmp.ini
c:\windows\system32\CdJklnmp.ini2
c:\windows\system32\k86.bin
c:\windows\system32\mcrh.tmp
c:\windows\system32\rAbJlnpo.ini
c:\windows\system32\rAbJlnpo.ini2
c:\windows\system32\wservice.exe

.
((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))
.

2008-11-13 14:36 . 2008-11-13 17:17 <DIR> d-------- C:\HaxFix
2008-11-13 14:13 . 2008-11-13 14:13 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Talkback
2008-11-10 03:09 . 2008-11-10 03:09 12,406 --a------ c:\windows\system32\rfs.bin
2008-11-05 07:03 . 2008-11-05 07:03 6,144 --ahs---- c:\windows\system32\access.ctl
2008-11-05 07:01 . 2008-11-05 07:01 <DIR> d-------- c:\program files\Sims2Programs.com
2008-11-03 05:52 . 2008-11-13 17:18 <DIR> d-------- c:\program files\GoodOk YouTube FLV to AVI 3GP MP4 WMV ASF Converter
2008-11-03 05:52 . 2008-11-03 05:52 34 --ah----- c:\windows\system32\VideoConverter_sysquict.dat
2008-11-03 05:51 . 2008-11-03 05:51 <DIR> d-------- c:\program files\Common Files\Download Manager
2008-10-25 03:03 . 2008-10-27 04:14 7 --a------ c:\windows\system32\axt.bin
2008-10-21 02:31 . 2008-10-21 02:31 664 --a------ c:\windows\system32\adr95.bin
2008-10-18 04:58 . 2008-10-18 05:15 4,870,512 --a------ c:\documents and settings\Johnson\flvplayer_setup.exe
2008-10-17 04:20 . 2008-10-17 04:20 8,576 --a------ c:\windows\system32\acup.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 21:21 4,784 ----a-w c:\program files\startuplist.txt
2008-11-14 21:11 3,768 ----a-w c:\program files\hijackthis.log
2008-11-13 21:55 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-13 17:09 --------- d-----w c:\program files\Trend Micro
2008-11-06 21:06 --------- d-----w c:\program files\EA GAMES
2008-10-17 18:37 --------- d-----w c:\program files\FLV Player
2008-10-09 19:27 --------- d-----w c:\program files\BHODemon 2
2008-10-05 21:14 667,978 ----a-w c:\windows\unins001.exe
2008-10-01 19:39 --------- d-----w c:\program files\MagicISO
2008-10-01 13:41 --------- d-----w c:\program files\ESET
2008-04-12 15:52 40,960 --sha-w c:\program files\Thumbs.db
2007-02-11 03:55 7,066,112 ----a-w c:\documents and settings\Johnson\mlnet.exe
2006-12-31 09:49 9,451,515 ----a-w c:\program files\vlc-0.8.6-win32.exe
2006-12-21 08:57 5,971,432 ----a-w c:\program files\Firefox Setup 2.0.0.1.exe
2006-11-02 10:21 1,068,468 ----a-w c:\program files\spamdel.exe
2006-11-01 14:20 281,088 ----a-w c:\program files\bt212eng.exe
2006-07-15 12:25 855,893 ----a-w c:\program files\FLVplayer_v0.0.4.exe
2005-11-18 09:27 461,762 ----a-w c:\program files\fglan120.zip
2005-11-08 11:12 186,587 ----a-w c:\program files\RootkitRevealer.zip
2005-10-17 12:18 5,037,072 ----a-w c:\program files\spybotsd14.exe
2005-09-03 12:11 3,109,587 ----a-w c:\program files\tcmp4.exe
2005-09-03 12:10 2,731,287 ----a-w c:\program files\bsplayer135.823.exe
2005-09-03 12:08 734,160 ----a-w c:\program files\VobSub_2.23.exe
2005-08-24 13:11 7,739,192 ----a-w c:\program files\DivXPlay.exe
2005-08-09 22:13 69,632 ----a-w c:\program files\config.exe
2005-07-02 12:00 2,161,337 ------w c:\program files\MOPSaver.exe
2005-06-29 12:03 322,048 ----a-w c:\program files\HTMLTrim.exe
2005-06-18 12:01 1,256 ----a-w c:\program files\Zoommdxc.rar
2005-06-05 11:14 88,764 ----a-w c:\program files\zipany.jar
2005-05-18 13:47 501,386 ----a-w c:\program files\WinOFFSetup.exe
2005-05-17 12:16 3,749,309 ----a-w c:\program files\PixelToolbox.zip
2005-04-25 09:59 1,017,879 ----a-w c:\program files\miranda-im-v0.4.exe
2005-02-27 11:52 727,191 ----a-w c:\program files\yztbr103.zip
2005-01-30 11:28 13,045,532 ----a-w c:\program files\mp3b057.zip
2005-01-01 08:51 24,837 ----a-w c:\program files\AnimGet.zip
2004-12-31 13:40 7,061,590 ----a-w c:\program files\XnView-win-full.exe
2004-12-31 13:32 2,889,085 ----a-w c:\program files\IconTweaker.exe
2004-12-17 06:24 13,334 ----a-w c:\program files\server.met
2004-12-12 12:18 104,423 ----a-w c:\program files\dex02.zip
2004-12-09 04:51 818,923 ----a-w c:\program files\nisedit2.0.1.exe
2004-12-09 04:45 1,731,527 ----a-w c:\program files\nsis203.exe
2004-11-18 10:37 1,638,148 ----a-w c:\program files\sdfree.exe
2006-06-07 13:37 56 --sh--r c:\windows\system32\B5FB349F01.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2004-10-26 1118208]
"Dirkey"="c:\program files\Dirkey2\dirkey.exe" [2003-12-08 114176]
"Quick Folders"="qfolders.cpl" [2000-02-10 c:\windows\system32\qfolders.cpl]

c:\documents and settings\Johnson\Start Menu\Programs\Startup\
BHODemon 2.0.lnk.disabled [2008-10-10 661]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk.disabled [2002-01-01 1766]
Office Startup.lnk.disabled [2003-12-18 736]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"nosimplestartmenu"= 0 (0x0)
"norecentdochistory"= 0 (0x0)
"maxrecentdocs"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2003-08-25 11:25 139264 c:\program files\Common Files\Stardock\MCPStub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\acup.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
"ATIPTA"=c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PHIME2002A"=c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PHIME2002ASync"=c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 2007\pccguide.exe"
"SpeedTouch USB Diagnostics"="c:\program files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe"
"ZPOINT32"=c:\windows\System32\ZPOINT32.exe
"Acecad.Wtxpload"=c:\windows\Acecad\Wtxpload.exe Acecad
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe"
"nod32kui"="c:\program files\Eset\nod32kui.exe" /WAITSERVICE

R1 acup;VPower Control Service;c:\windows\System32\acup.sys [2008-10-17 8576]
R2 Maxtor Sync Service;Maxtor Service;"c:\program files\Maxtor\Sync\SyncServices.exe" [2007-09-28 156976]
R3 METROP;Canon scaner FB310;c:\windows\System32\DRIVERS\as260n.sys [2008-03-25 238016]
S3 VundoFixSvc;VundoFix Service;VundoFixSVC.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{300E1A90-B51D-174A-0208-010407000508}]
c:\windows\System32\vmst32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7844B5A1-88C6-C0D9-0309-F9B8B284CC3E}]
c:\windows\System32\dllcache\NTGuard.exe s
.
Contents of the 'Scheduled Tasks' folder

2008-11-17 c:\windows\Tasks\cmd.job
- c:\windows\system32\cmd.exe [2002-08-29 23:00]
.
- - - - ORPHANS REMOVED - - - -

Notify-acpiz - acpiz.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Johnson\Application Data\Mozilla\Firefox\Profiles\vo462ck4.icer\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-US.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-17 15:23:43
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\ESET\nod32krn.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Stardock\sdmcp.exe
c:\windows\system32\drivers\WtSrv.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-11-17 17:07:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-17 06:07:43

Pre-Run: 4,530,491,392 bytes free
Post-Run: 4,764,479,488 bytes free

winxpsp1_en_hom_bf.exe

timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect

252
[B]---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:27:36 AM, on 18/11/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\Drivers\WTSRV.EXE
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dirkey2\dirkey.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\renamed.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Dirkey] C:\Program Files\Dirkey2\dirkey.exe
O4 - HKCU\..\Run: [Quick Folders] rundll32 qfolders.cpl,Load
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: BHODemon 2.0.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Office Startup.lnk.disabled
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Unknown owner - VundoFixSVC.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--

[Blade81]

Hi

Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode

On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer


Show hidden files
-----------------
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.


Upload following file to http://www.virustotal.com and post back the results:
c:\windows\System32\acup.sys


Start hjt, do a system scan, check (if found):
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Close browsers and fix checked.


Open notepad and copy/paste the text in the quotebox below into it:



File::
c:\documents and settings\Johnson\mlnet.exe
c:\program files\MOPSaver.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{300E1A90-B51D-174A-0208-010407000508}]

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7844B5A1-88C6-C0D9-0309-F9B8B284CC3E}]



Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Uninstall old Java versions and get Java 6 Update 7 here (http://javadl.sun.com/webapps/download/AutoDL?BundleId=23111).


Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/virusscanner) as instructed in the screenshot here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif).


Post back its report, a fresh hjt log and above mentioned ComboFix resultant log.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.