Virtuemonde - my new enemy

[cgesuald]

Please help

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:11:35 AM, on 1/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\SYMANT~1\vptray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Active SMART\ActiveSMART.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {54244CB5-C052-4044-A229-CC6582E80796} - C:\WINDOWS\system32\ljJdaYsS.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\tuvTklKC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {77AB5974-55A3-4737-9FD5-B93C64307F78} - C:\WINDOWS\system32\luwwotaj.dll
O2 - BHO: (no name) - {C2D05AF2-B982-47BA-B280-ED2C3E388DF0} - (no file)
O2 - BHO: (no name) - {e0b264f4-b96f-47c2-81d5-131fe46ea6b1} - C:\WINDOWS\system32\jineniwi.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [TizzleTalk] C:\Program Files\TizzleTalk\TizzleTalk.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [zewulorobe] Rundll32.exe "C:\WINDOWS\system32\dutewene.dll",s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKCU\..\Run: [L06AXLRD_2089546] "C:\Program Files\Microsoft Student\Microsoft Student 2006 DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [zewulorobe] Rundll32.exe "C:\WINDOWS\system32\dutewene.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [zewulorobe] Rundll32.exe "C:\WINDOWS\system32\dutewene.dll",s (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe (User 'Default user')
O4 - Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Tinypic Publisher - http://tinypic.com/flix/tinypic_publisher.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1145414710514
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145414785921
O20 - AppInit_DLLs: ,wydgbg.dll,jvwzyn.dll,C:\WINDOWS\system32\niyojado.dll iwghno.dll
O20 - Winlogon Notify: tuvTklKC - C:\WINDOWS\SYSTEM32\tuvTklKC.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenCASE Media Agent - ExtendMedia Inc. - C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 8991 bytes

[ken545]

Hello cgesuald,

Welcome to Safer Networking.

Please read Before You Post
That said, All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.



Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

[cgesuald]

ComboFix 09-01-31.01 - Owner 2009-01-31 19:19:15.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.585 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Owner\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\Owner\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\allyourbasearebelongtous.exe
c:\windows\system32\adosuyon.ini
c:\windows\system32\afuduzav.ini
c:\windows\system32\atapehir.ini
c:\windows\system32\atekikun.ini
c:\windows\system32\bedkpnpq.ini
c:\windows\system32\devopaha.dll
c:\windows\system32\dezuzara.dll
c:\windows\system32\dfhplsfu.dll
c:\windows\system32\dijozadu.dll
c:\windows\system32\dipadove.dll
c:\windows\system32\divonira.dll
c:\windows\system32\doyokiza.dll
c:\windows\system32\drivers\RKHit.sys
c:\windows\system32\egejeyev.ini
c:\windows\system32\enofebej.ini
c:\windows\system32\epesowoj.ini
c:\windows\system32\fihofupe.dll
c:\windows\system32\fikujeve.dll
c:\windows\system32\fojifuse.dll.tmp
c:\windows\system32\fopotami.dll
c:\windows\system32\fyypiryk.dll
c:\windows\system32\gajilife.dll
c:\windows\system32\hilugira.dll.tmp
c:\windows\system32\hobavana.dll
c:\windows\system32\hogikata.dll.tmp
c:\windows\system32\husamiza.dll
c:\windows\system32\ikazanol.ini
c:\windows\system32\iwghno.dll
c:\windows\system32\iwuyumev.ini
c:\windows\system32\jineniwi.dll
c:\windows\system32\jqnkjlqm.dll
c:\windows\system32\jureviji.dll
c:\windows\system32\jvwzyn.dll
c:\windows\system32\jxwbcttn.dll
c:\windows\system32\kebawute.dll
c:\windows\system32\kesufeyi.dll
c:\windows\system32\kifebodi.dll
c:\windows\system32\kitariji.dll.tmp
c:\windows\system32\kjojxx.dll
c:\windows\system32\kukezifu.dll
c:\windows\system32\lelohute.dll
c:\windows\system32\lijohoyo.dll
c:\windows\system32\lirufito.dll
c:\windows\system32\ljJdaYsS.dll
c:\windows\system32\lonazaki.dll
c:\windows\system32\lubgedlt.dll
c:\windows\system32\luwwotaj.dll
c:\windows\system32\malanade.dll.tmp
c:\windows\system32\mcrh.tmp
c:\windows\system32\melepoju.dll
c:\windows\system32\mibuvure.dll
c:\windows\system32\midepoba.dll
c:\windows\system32\mirajehi.dll
c:\windows\system32\misahavu.dll
c:\windows\system32\monajole.dll
c:\windows\system32\mufayehu.dll
c:\windows\system32\musesiwo.dll
c:\windows\system32\mvueexsc.dll
c:\windows\system32\ndzxjx.dll
c:\windows\system32\nijopido.dll
c:\windows\system32\niyojado.dll
c:\windows\system32\nojelawo.dll
c:\windows\system32\noyusoda.dll
c:\windows\system32\nukiketa.dll
c:\windows\system32\nutuvuga.dll
c:\windows\system32\ojugozov.ini
c:\windows\system32\otanijud.ini
c:\windows\system32\ovipipuf.ini
c:\windows\system32\oyanekob.ini
c:\windows\system32\ozomorar.ini
c:\windows\system32\pinojudu.dll
c:\windows\system32\pjgvqcnn.dll
c:\windows\system32\prunnet.exe
c:\windows\system32\pudadato.dll
c:\windows\system32\qpnpkdeb.dll
c:\windows\system32\rajijofa.dll
c:\windows\system32\raromozo.dll
c:\windows\system32\raxtrmmn.ini
c:\windows\system32\rerujiku.dll.tmp
c:\windows\system32\rifajazu.dll
c:\windows\system32\rihepata.dll
c:\windows\system32\rimasafi.dll
c:\windows\system32\ritibiji.dll
c:\windows\system32\romaziha.dll
c:\windows\system32\royizela.dll
c:\windows\system32\sapahore.dll
c:\windows\system32\sekisahi.dll
c:\windows\system32\sovegome.dll
c:\windows\system32\SsYadJjl.ini
c:\windows\system32\SsYadJjl.ini2
c:\windows\system32\supilime.dll
c:\windows\system32\tenudoki.dll
c:\windows\system32\teputedu.dll
c:\windows\system32\tipigipu.dll
c:\windows\system32\totuguri.dll
c:\windows\system32\tsdnme.dll
c:\windows\system32\tuvTklKC.dll
c:\windows\system32\udetupet.ini
c:\windows\system32\ufizekuk.ini
c:\windows\system32\ufslphfd.ini
c:\windows\system32\ukojuhoy.ini
c:\windows\system32\uruwotoz.ini
c:\windows\system32\usrgfil.dll
c:\windows\system32\vawuwiha.dll
c:\windows\system32\vazudufa.dll
c:\windows\system32\vefikebi.dll
c:\windows\system32\vemuyuwi.dll
c:\windows\system32\veyejege.dll
c:\windows\system32\vozogujo.dll
c:\windows\system32\wazuhope.dll
c:\windows\system32\wefeyubi.dll
c:\windows\system32\wifekeba.dll
c:\windows\system32\wuzazojo.dll
c:\windows\system32\wydgbg.dll
c:\windows\system32\yavafike.dll
c:\windows\system32\ygtdtnms.dll
c:\windows\system32\zakisohi.dll
c:\windows\system32\zasakika.dll
c:\windows\system32\zatajipi.dll
c:\windows\system32\zijubeha.dll
c:\windows\system32\zotowuru.dll
c:\windows\system32\zukowana.dll
c:\windows\wiaserviv.log
E:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://77.74.48.101
hxxp://77.74.48.105
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_RkHit


((((((((((((((((((((((((( Files Created from 2009-01-01 to 2009-02-01 )))))))))))))))))))))))))))))))
.

2009-01-30 14:09 . 2009-01-30 14:10 664 --a------ c:\windows\system32\d3d9caps.dat
2009-01-29 19:53 . 2009-01-29 19:53 <DIR> d-------- c:\documents and settings\Administrator
2009-01-21 17:41 . 2009-01-21 17:41 <DIR> d-------- c:\program files\iPod
2009-01-21 17:41 . 2009-01-21 17:42 <DIR> d-------- C:\iTunes
2009-01-21 17:41 . 2009-01-21 17:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-21 17:36 . 2009-01-21 17:37 <DIR> d-------- c:\program files\QuickTime
2009-01-15 21:46 . 2009-01-15 21:46 <DIR> d-------- c:\documents and settings\Owner\Application Data\Pegasys Inc
2009-01-15 21:45 . 2009-01-15 21:45 40,960 --a------ c:\windows\system32\jwrjablw.dll
2009-01-15 20:21 . 2009-01-15 20:21 <DIR> d-------- c:\program files\Trend Micro
2009-01-11 13:44 . 2009-01-11 14:04 <DIR> d-------- C:\.jagex_cache_32
2009-01-11 13:44 . 2009-01-11 15:12 31 --a------ c:\documents and settings\kablam\jagex_runescape_preferences.dat
2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\system32\QuickTime.qts
2009-01-03 16:49 . 2009-01-03 16:49 2,713 --ahs---- c:\windows\system32\latalelu.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-01 00:36 --------- d-----w c:\program files\Active SMART
2009-02-01 00:05 --------- d-----w c:\program files\Symantec AntiVirus
2009-02-01 00:05 --------- d-----w c:\program files\Symantec
2009-02-01 00:05 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-01 00:05 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-01-31 22:21 34 ----a-w c:\documents and settings\Owner\jagex_runescape_preferences.dat
2009-01-29 19:57 --------- d-----w c:\documents and settings\Owner\Application Data\FrostWire
2009-01-21 22:40 --------- d-----w c:\program files\Common Files\Apple
2009-01-21 22:26 --------- d-----w c:\program files\SightSpeed
2009-01-21 22:11 --------- d-----w c:\program files\DivX
2009-01-13 11:44 --------- d-----w c:\program files\FrostWire
2009-01-04 06:54 --------- d-----w c:\program files\Incomplete
2008-12-30 20:43 --------- d-----w c:\program files\Vuze
2008-12-30 20:42 --------- d-----w c:\documents and settings\Owner\Application Data\Azureus
2008-12-29 04:45 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
2008-12-29 03:58 --------- d-----w c:\documents and settings\All Users\Application Data\ExtendMedia
2008-12-29 03:57 --------- d-----w c:\program files\OpenCase
2008-12-28 06:50 --------- d-----w c:\program files\YouTube Downloader
2008-12-26 04:05 --------- d-----w c:\program files\virusAskSBar
2008-12-26 03:28 --------- d-----w c:\documents and settings\Owner\Application Data\Lavasoft
2008-12-26 03:26 --------- d-----w c:\program files\Unlocker
2008-12-26 02:05 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-26 01:08 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-26 01:05 --------- d-----w c:\program files\Enigma Software Group
2008-12-24 23:41 --------- d-----w c:\program files\Bonjour
2008-12-24 23:39 --------- d-----w c:\program files\Apple Software Update
2008-12-24 21:18 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2008-12-23 00:50 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-22 23:18 --------- d-----w c:\program files\Eye Games
2008-12-22 23:18 --------- d-----w c:\program files\Common Files\SWF Studio
2008-12-21 22:11 --------- d-----w c:\documents and settings\Owner\Application Data\Creative
2008-12-21 22:05 --------- d-----w c:\program files\Creative
2008-12-21 22:05 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-14 22:48 --------- d-----w c:\documents and settings\Owner\Application Data\gtk-2.0
2008-12-11 00:54 --------- d-----w c:\documents and settings\Owner\Application Data\DivX
2008-12-07 04:29 --------- d-----w c:\program files\Perfect Uninstaller
2008-12-07 01:24 --------- d-----w c:\documents and settings\owner_2\Application Data\Lavasoft
2008-11-27 02:59 81 ----a-w C:\CTX.DAT
2008-09-30 20:46 83,968 --sha-w c:\windows\system32\garayudi.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative WebCam Tray"="c:\program files\Creative\Shared Files\CamTray.exe" [2005-03-29 258048]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-06-20 1056768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-01 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\itunes\iTunesHelper.exe" [2009-01-06 290088]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-07-22 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe]
"PD0620 STISvc"="P0620Pin.dll" [2005-05-10 c:\windows\system32\P0620Pin.dll]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Active SMART.lnk - c:\program files\Active SMART\ActiveSMART.exe [2004-04-02 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.aflc"= flccodec32.dll
"vidc.afli"= flccodec32.dll
"vidc.aasc"= aasc32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\PlayLinc\\AIMPlayLinc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\OpenCase\\OpenCASE Media Agent\\PandoBinaries\\NBCPandoREST.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57661:TCP"= 57661:TCP:PandoRest Listening Port

R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-07-29 138801]
R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2004-07-29 46800]
R4 OpenCASE Media Agent;OpenCASE Media Agent;c:\program files\OpenCase\OpenCASE Media Agent\MediaAgent.exe [2008-08-29 835208]
R4 PDSched;PDScheduler;c:\program files\Raxco\PerfectDisk\PDSched.exe [2005-11-29 241731]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [2006-10-19 10664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{509b6c0a-bca7-11dd-a1df-806d6172696f}]
\Shell\AutoRun\command - G:\Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{727780ec-df44-11dd-a201-00142a6736f3}]
\Shell\AutoRun\command - F:\Installer.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-02-01 c:\windows\Tasks\mzlcswyo.job
- c:\windows\system32\cbXNEttT.dll []
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
BHO-{5D5A703A-36BC-403D-A881-E1E611834684} - c:\windows\system32\ljJdaYsS.dll
BHO-{C2D05AF2-B982-47BA-B280-ED2C3E388DF0} - (no file)
BHO-{e0b264f4-b96f-47c2-81d5-131fe46ea6b1} - c:\windows\system32\jineniwi.dll
WebBrowser-{6A719530-8443-4898-9BC4-69E76B5F1C89} - c:\program files\ShareThis Toolbar\share2me.dll
HKCU-Run-L06AXLRD_2089546 - c:\program files\Microsoft Student\Microsoft Student 2006 DVD\EDICT.EXE
HKLM-Run-Name of App - c:\program files\SAMSUNG\FW LiveUpdate\Liveupdate.exe
HKLM-Run-C2K - c:\windows\Cyb2k.exe
HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
HKLM-Run-TizzleTalk - c:\program files\TizzleTalk\TizzleTalk.exe
HKLM-Run-zewulorobe - c:\windows\system32\dutewene.dll
HKLM-Run-68e23bc2 - c:\windows\system32\qpnpkdeb.dll
Notify-NavLogon - (no file)


.
------- Supplementary Scan -------
.
uStart Page = www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\lspcs.dll
DPF: Tinypic Publisher - hxxp://tinypic.com/flix/tinypic_publisher.CAB
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-31 19:36:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Name of App = c:\program files\SAMSUNG\FW LiveUpdate\Liveupdate.exe??w???w???????w???wH?j????????????w????`???`??????????????????????|????]??w`???)?E??????!;???D???J??????bD???????;?`???????/?F?`???b?@?`???]??w????)?E????????????????????w???w????????????????????????????(?G

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\PSSdk23]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk23.drv"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(900)
c:\windows\system32\lspcs.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\gearsec.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-31 19:39:29 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-01 00:39:09

Pre-Run: 158,920,400,896 bytes free
Post-Run: 159,651,590,144 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

334 --- E O F --- 2008-12-26 23:01:08


Below are the results from HJT.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:45 PM, on 1/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Active SMART\ActiveSMART.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - S-1-5-18 Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe (User 'Default user')
O4 - Startup: Active SMART.lnk = C:\Program Files\Active SMART\ActiveSMART.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Tinypic Publisher - http://tinypic.com/flix/tinypic_publisher.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1145414710514
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145414785921
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenCASE Media Agent - ExtendMedia Inc. - C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

--
End of file - 6445 bytes

[ken545]

Hello,

Just a bit more to do.

c:\program files\FrostWire
Read this please about P2P File Sharing Programs

We have noticed that many people seeking help from us are coming with infections contracted from the use of P2P programs.

Because of this, we changed our malware forum's policy on the use of P2P file sharing programs.

• If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.
• If we clean your computer of infection, and you return to us a short time later with an infection contracted by the use of P2P programs, volunteer analysts will refuse their help.

We do not ask you to do this without reason.


P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/article/07/09/06/...ID-theft_1.html

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

You need to enable windows to Show all Files and Folders
Instructions for your Operating System HERE

Delete these files, let me know if they where deleted and if not which ones would not delete
c:\windows\system32\jwrjablw.dll
c:\windows\system32\latalelu.dll
c:\windows\system32\garayudi.dll
c:\windows\Tasks\mzlcswyo.job




c:\program files\virusAskSBar <--Never seen this before, do you use it??





Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.<-- Don't forget this
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and Paste the entire report in your next reply along with a New Hijackthis log.

[ken545]

Due to inactivity, this thread will now be closed.

Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.