Win32.TDSS.RTK trojan problem.

The computer had a lot of malware, trojans, and spyware on it. I did use SpyBot, after several run throughs, it cleaned up everything except the Win32.TDSS.RTK

Your help in removing this would be appreciated. I did run ERUNT and added the Hijackthis log file below.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:44 PM, on 1/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://a-v-pro-2010.com/buy.html?wmi...91bfd77cc0086b
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\IPSBHO.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [75922934] C:\Documents and Settings\All Users\Application Data\75922934\75922934.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA9869] command.com /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9015] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8625] command.com /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1912] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9997] command.com /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5927] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1794] command.com /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2875] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6003] command.com /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7895] cmd.exe /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7474] command.com /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1639] cmd.exe /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8201] command.com /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3482] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4844] command.com /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5600] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5618] command.com /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1387] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2270] command.com /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4920] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4915] command.com /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC633] cmd.exe /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2141] command.com /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5993] cmd.exe /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6498] command.com /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5831] cmd.exe /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7539] command.com /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9704] cmd.exe /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5912] command.com /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9615] cmd.exe /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2432] command.com /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5056] cmd.exe /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8257] command.com /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1875] cmd.exe /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2035] command.com /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC430] cmd.exe /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6646] command.com /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1561] cmd.exe /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2825] command.com /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3001] cmd.exe /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [McAfee Update] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mcupdate_1291998491.exe /syncfin C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mcupdate_1291998491.ini
O4 - HKCU\..\RunOnce: [SpybotDeletingB1054] command.com /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6190] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7189] command.com /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1571] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkydiusqfxw.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6969] command.com /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9790] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4584] command.com /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5057] cmd.exe /c del "C:\WINDOWS\system32\drivers\gasfkynwmitetb.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9112] command.com /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9384] cmd.exe /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB717] command.com /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9068] cmd.exe /c del "C:\WINDOWS\system32\gasfkybmiaqvns.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3624] command.com /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1952] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8482] command.com /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7332] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjltvrecv.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9558] command.com /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7716] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8051] command.com /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD141] cmd.exe /c del "C:\WINDOWS\system32\gasfkyjmdtspux.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB974] command.com /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7281] cmd.exe /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4787] command.com /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4863] cmd.exe /c del "C:\WINDOWS\system32\gasfkyqrcqobcv.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4867] command.com /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6163] cmd.exe /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5330] command.com /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4662] cmd.exe /c del "C:\WINDOWS\system32\gasfkycnvtmspf.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9673] command.com /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6615] cmd.exe /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3635] command.com /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1085] cmd.exe /c del "C:\WINDOWS\system32\gasfkytmxlximk.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8035] command.com /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9013] cmd.exe /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7996] command.com /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5052] cmd.exe /c del "C:\WINDOWS\system32\gasfkyxiouqsjt.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7282] command.com /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9455] cmd.exe /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8605] command.com /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9189] cmd.exe /c del "C:\WINDOWS\system32\gasfkyywqkgbsa.dat"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: ymetray.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Backgammon - http://origin.games.yahoo.net/games/clients/y/at1_x.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1291997613750
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1291998220046
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: ,huwakalu.dll c:\windows\system32\kuzeduhu.dll
O21 - SSODL: rutetazek - {2db1e547-6ed4-44c9-b327-3a65b70b268c} - c:\windows\system32\kuzeduhu.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {2db1e547-6ed4-44c9-b327-3a65b70b268c} - c:\windows\system32\kuzeduhu.dll (file missing)
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 15554 bytes

Hi bgjoy6160

Please post next spybot report and HijackThis log taken in normal mode :)

Shaba,

My Internet Explorer was hyjacked, so I fixed that then things calmed down.

I ran the Norton Anitvirus and anti spyware in each of the user accounts on the system. It removed the trojan. I ran Spybot again and all appears to be back to normal.

Thanks for the help.

I still recommend to follow my previous instructions :)

Due to the lack of feedback this Topic is closed.

If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

Everyone else please begin a New Topic.